Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WeChat-Setup (3).exe

Overview

General Information

Sample name:WeChat-Setup (3).exe
Analysis ID:1562678
MD5:565a84e92861a1aa6e96c8b2f95495bb
SHA1:0e43a28323124b99f37de8b4ec1230228af8a759
SHA256:e4d894b1d5e983b341fcf292ff8302414099f0a5f8eaa07e8a69e9b62332292b
Tags:checkexeinstalltestuser-Pekomposo19999
Infos:

Detection

Score:28
Range:0 - 100
Whitelisted:false
Confidence:0%

Signatures

Drops large PE files
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • WeChat-Setup (3).exe (PID: 7460 cmdline: "C:\Users\user\Desktop\WeChat-Setup (3).exe" MD5: 565A84E92861A1AA6E96C8B2F95495BB)
  • WeChat.exe (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" MD5: D30F4A09FFEB923F4A05A655600F6BB9)
    • WeChat.exe (PID: 1732 cmdline: "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2 MD5: D30F4A09FFEB923F4A05A655600F6BB9)
    • explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
    • WeChat.exe (PID: 7352 cmdline: "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3 MD5: D30F4A09FFEB923F4A05A655600F6BB9)
    • WeChat.exe (PID: 7176 cmdline: "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --app-path="C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1 MD5: D30F4A09FFEB923F4A05A655600F6BB9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: WeChat-Setup (3).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d1788b9d-fe46-5f15-8398-75060bd3532cJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\LICENSE.electron.txtJump to behavior
Source: WeChat-Setup (3).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1980997703.0000000002EA4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ffmpeg.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1884152741.00000000051D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1882456833.00000000051D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: WeChat-Setup (3).exe, 00000000.00000003.1882456833.00000000051D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .Pdb> source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1900516806.00000000051D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1855131370.0000000007430000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1900516806.00000000051D4000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_004059CC
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_004065FD FindFirstFileW,FindClose,0_2_004065FD
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00402868 FindFirstFileW,0_2_00402868
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\Programs\wechatappJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.1/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.1:1337/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.1:80/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.2/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.2:1337/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://10.0.0.2:80/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1/32
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://a.b.example
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136dumpTranslatedShadersWrite
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/342316794
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/345244067
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355034686
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355645824
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/355645824Frontend
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096371expandIntegerPowExpressionsThe
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096454
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096464
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096480
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096530
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096539
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096601
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096608allowES3OnFL100Allow
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096643
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096648
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096661
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096758
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096838
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40096838cacheCompiledShaderEnable
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644593
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644627skipVSConstantRegisterZeroIn
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644663
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644715
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644730
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644740
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644747
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644776
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644912
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/40644912enableTranslatedShaderSubstitutionCheck
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/41488637
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/41493495
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260492
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260591
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42260722
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261226
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261713
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261756
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261881
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261882
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42261924allowClearForRobustResourceInitSome
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262115
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262161
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262166
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262239
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262247
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262249
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262258
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262286
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262287
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262386
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262476
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262506
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262605
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42262955
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263010
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263031
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263049
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263158
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263239
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263322
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263407
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263477
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263580
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263580disableDrawBuffersIndexedDisable
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263622
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263629
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263911
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263914
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263960
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42263969
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264008
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264071
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264193
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264193forceGlErrorCheckingForce
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264287
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264287forceRobustResourceInitForce-enable
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264422
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264443
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264446
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264571
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264571forceInitShaderVariablesForce-enable
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264577
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264669
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264767
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42264951
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265147
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265186
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265248
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265353
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265369
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265370
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265407
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265429
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265509
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265509dumpShaderSourceWrite
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265516
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265647
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265841
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265878
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265957
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42265995
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266019
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266021
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266024
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266194
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266194disableAnisotropicFilteringDisable
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266231
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266231enableShaderSubstitutionCheck
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266232
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266232disableProgramCachingDisables
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266602
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266610
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266652
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266666
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266725
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266842
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMake
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266906
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42266976
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267038
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267045
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267057
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267082ProgramGL::postLinkJobImpl
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267095
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/42267113
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/lao-dictionary/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1094869
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/110263
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1144207
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1171371
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181068
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1181193
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1420130
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1434317
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/1456243
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/308366
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/350528343
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/403957
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/550292
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/565179
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642227
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/642605
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/644669
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/650547
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/672380
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/709351
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/797243
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/809422
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/830046
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/883276
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/927470
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://example.no
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://example.sub
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980997703.0000000002EA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://int3.de/
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jongleberry.com)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary.txt
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://no.sub.example
Source: WeChat-Setup (3).exe, 00000000.00000000.1675403968.000000000040A000.00000008.00000001.01000000.00000003.sdmp, WeChat-Setup (3).exe, 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.org/licenses/MIT
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://skbug.com/9491
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1854555992.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/16459606/376773
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/398120/376773
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/5982798/376773
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sub.example
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sub.example:1337
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sub.example:80
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tjholowaychuk.com)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://unexpected.proxy
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/):
Source: WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1854555992.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.finesse.demon.co.uk/steven/sqrt.html.
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jaredhanson.net/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/NPL/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.apple.com/apsl/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html.
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x.prefexample
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/tsconfig.json
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/360031000
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096376
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40096712
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40644738
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/40644850
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/41488638
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263273
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263540
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42263702
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42264072
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42264383
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265636
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265637
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265720
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265720enableCaptureLimitsSet
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265782
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265792
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265794
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265839
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265854
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265877
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42265958
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266070
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266183
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266319
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266364
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266740
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266745
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266748
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266811
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42266842
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42267038
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/42267098
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/8646
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3056
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=4118
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1855131370.0000000007430000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/external/github.com/intel/tinycbor.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1038223.
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1042393
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1046462
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1060012
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1091824
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1137851
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1300575
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1356053
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40279678
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/40488750
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/619103.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/619103.Subsequence
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/705865
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/710443
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/811661
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/848952
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119Blink.Script.SchedulingTypeScriptLoader
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/981419
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://eslint.org/docs/rules/no-buffer-constructor)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://git.io/debug_fd)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChALkeR
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChALkeR/safer-buffer.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rob--W/proxy-from-env#readme
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rob--W/proxy-from-env.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/wasm-c-api/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalker/safer-buffer#why-not-safe-buffer)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalker/safer-buffer#why-not-safe-buffer).
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dpranke/typ.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/react-native/pull/1632
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47164
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/flutter/flutter/issues/47804
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wicked-good-xpath
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/object-inspect
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyeecheung/node-dep-codemod#dep005)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/issues/1726
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/pull/7878
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/qs
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/qs.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/qs/graphs/contributors)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/set-function-length#readme
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/set-function-length.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/side-channel#readme
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/side-channel.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-deprecated-api.md)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/Release#release-schedule)).
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/patrickhulce/third-party-web
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/path-to-regexp.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/send/issues)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stream-utils/raw-body/issues)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/test262-utils/test262-harness-py
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/ServiceWorker/issues/1356.Property
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805Custom
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wesleytodd/setprototypeof
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wesleytodd/setprototypeof.git
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeux/volk
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-engine
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22Media
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22RemoveElementFromDocumentMapit
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/155487768
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/288119108
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292282210
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899forceMinimumMaxVertexAttributesForce
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/309028728
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/311022968
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/328301788
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/328837151
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/336844257
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/347601787
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/349489248
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/349489248rejectWebglShadersWithUndefinedBehaviorAttempts
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/en/docs/inspector
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/xnu/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ponyfill.com/)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/webapp2
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://robwu.nl/)
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shorturl.at/drFY7)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/project/?group_id=1519
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/funding/github/npm/object-inspect
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/>.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.Blocked
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/uievents/#legacy-event-types)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webkit.org/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648Renderer.Font.PrimaryFont.FCPRenderer.Font.Prim
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chromium.org
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/spir/visualizer/
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/buffer-alloc)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/buffer-from)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/safe-buffer)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/safer-buffer)
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/.
Source: WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zod.dev
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00405461
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE memstr_64611fd7-d

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile dump: WeChat.exe.0.dr 188637696Jump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile dump: WeChat.exe0.0.dr 188637696Jump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00406B150_2_00406B15
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_004072EC0_2_004072EC
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00404C9E0_2_00404C9E
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess token adjusted: SecurityJump to behavior
Source: WeChat.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: WeChat.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1909583600.00000000051D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename. vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1900516806.00000000051D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1980997703.0000000002EA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameElevate.exeH vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1882456833.00000000051D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1854555992.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilename. vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exe, 00000000.00000003.1751126439.0000000005D16000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs WeChat-Setup (3).exe
Source: WeChat-Setup (3).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: sus28.winEXE@8/136@0/0
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_00404722
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00402104 CoCreateInstance,0_2_00402104
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeMutant created: \Sessions\1\BaseNamedObjects\d1788b9d-fe46-5f15-8398-75060bd3532c
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nseAE4E.tmpJump to behavior
Source: WeChat-Setup (3).exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000007278000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile read: C:\Users\user\Desktop\WeChat-Setup (3).exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\WeChat-Setup (3).exe "C:\Users\user\Desktop\WeChat-Setup (3).exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe"
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --app-path="C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --app-path="C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1Jump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: iconcodecservice.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: iconcodecservice.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: windows.globalization.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: bcp47mrm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: directmanipulation.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: msspellcheckingfacility.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeSection loaded: mswsock.dll
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d1788b9d-fe46-5f15-8398-75060bd3532cJump to behavior
Source: WeChat-Setup (3).exeStatic file information: File size 82367982 > 1048576
Source: WeChat-Setup (3).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1980997703.0000000002EA4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ffmpeg.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1884152741.00000000051D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1882456833.00000000051D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: WeChat-Setup (3).exe, 00000000.00000003.1882456833.00000000051D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .Pdb> source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1900516806.00000000051D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1855131370.0000000007430000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1900516806.00000000051D4000.00000004.00000020.00020000.00000000.sdmp
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll0.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll0.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll0.0.drStatic PE information: section name: _RDATA
Source: WeChat.exe.0.drStatic PE information: section name: .gxfg
Source: WeChat.exe.0.drStatic PE information: section name: .retplne
Source: WeChat.exe.0.drStatic PE information: section name: .rodata
Source: WeChat.exe.0.drStatic PE information: section name: CPADinfo
Source: WeChat.exe.0.drStatic PE information: section name: LZMADEC
Source: WeChat.exe.0.drStatic PE information: section name: _RDATA
Source: WeChat.exe.0.drStatic PE information: section name: malloc_h
Source: WeChat.exe.0.drStatic PE information: section name: prot
Source: WeChat.exe0.0.drStatic PE information: section name: .gxfg
Source: WeChat.exe0.0.drStatic PE information: section name: .retplne
Source: WeChat.exe0.0.drStatic PE information: section name: .rodata
Source: WeChat.exe0.0.drStatic PE information: section name: CPADinfo
Source: WeChat.exe0.0.drStatic PE information: section name: LZMADEC
Source: WeChat.exe0.0.drStatic PE information: section name: _RDATA
Source: WeChat.exe0.0.drStatic PE information: section name: malloc_h
Source: WeChat.exe0.0.drStatic PE information: section name: prot
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\WeChat.exeJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Local\Programs\wechatapp\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WeChat.lnkJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 848Jump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\wechatapp\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\wechatapp\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\wechatapp\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\wechatapp\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\wechatapp\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile Volume queried: C:\Users\user\AppData\Roaming\WeChat\Code Cache\wasm FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile Volume queried: C:\Users\user\AppData\Roaming\WeChat\blob_storage\0e33d1a9-6704-4aba-90a8-ac719f5d9c8d FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile Volume queried: C:\Users\user\AppData\Roaming\WeChat\Code Cache\js FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeFile Volume queried: C:\Users\user\AppData\Roaming\WeChat FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_004059CC
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_004065FD FindFirstFileW,FindClose,0_2_004065FD
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_00402868 FindFirstFileW,0_2_00402868
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\Programs\wechatappJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeFile opened: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: explorer.exe, 00000008.00000000.2065777372.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: explorer.exe, 00000008.00000000.2064617442.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000008.00000000.2053916814.00000000078A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000008.00000000.2065777372.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000008.00000000.2047460973.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000008.00000000.2053916814.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.2065777372.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: WeChat-Setup (3).exe, 00000000.00000003.1981382525.0000000002E98000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 63}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.2053916814.00000000078AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTTAVMWare
Source: explorer.exe, 00000008.00000000.2064617442.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTest
Source: explorer.exe, 00000008.00000000.2064617442.00000000097D4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: explorer.exe, 00000008.00000000.2065777372.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: WeChat-Setup (3).exe, 00000000.00000003.1884152741.00000000051D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgaR
Source: explorer.exe, 00000008.00000000.2053916814.0000000007A34000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnx
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: explorer.exe, 00000008.00000000.2047460973.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000008.00000000.2064617442.0000000009660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: WeChat-Setup (3).exe, 00000000.00000003.1884152741.00000000051D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: explorer.exe, 00000008.00000000.2047460973.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeAPI call chain: ExitProcess graph end nodegraph_0-3407
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --app-path="C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\wechat" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\wechat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\wechat" --app-path="c:\users\user\appdata\local\programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\wechat" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\wechat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeProcess created: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe "c:\users\user\appdata\local\programs\wechatapp\wechat.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\wechat" --app-path="c:\users\user\appdata\local\programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1Jump to behavior
Source: explorer.exe, 00000008.00000000.2064617442.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2053399393.0000000004CE0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.2047460973.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman$
Source: WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Users\user\AppData\Local\Programs\wechatapp\resources VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\WeChat-Setup (3).exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter		1
Windows Service		1
Access Token Manipulation		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
Windows Service		1
Access Token Manipulation		LSASS Memory2
Process Discovery		Remote Desktop Protocol1
Archive Collected Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		12
Process Injection		12
Process Injection		Security Account Manager1
Application Window Discovery		SMB/Windows Admin Shares1
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		NTDS1
Remote System Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Side-Loading		Software PackingLSA Secrets3
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials24
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562678 Sample: WeChat-Setup (3).exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 28 27 Drops large PE files 2->27 6 WeChat-Setup (3).exe 19 199 2->6         started        9 WeChat.exe 49 2->9         started        process3 file4 19 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 6->19 dropped 21 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 6->21 dropped 23 C:\Users\user\AppData\Local\...\System.dll, PE32 6->23 dropped 25 17 other files (none is malicious) 6->25 dropped 11 WeChat.exe 1 9->11         started        13 WeChat.exe 10 9->13         started        15 explorer.exe 29 8 9->15 injected 17 WeChat.exe 9->17         started        process5

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\wechatapp\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\wechatapp\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\wechatapp\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\wechatapp\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\wechatapp\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\wechatapp\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://example.sub0%Avira URL Cloudsafe
http://127.0.0.1/320%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/simplejson/simplejsonWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://anglebug.com/40096661WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      http://anglebug.com/42262161WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://anglebug.com/42265794WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://anglebug.com/42263010WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://anglebug.com/42265792WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              http://anglebug.com/42262286WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                http://anglebug.com/42262166WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://anglebug.com/42262287WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://crbug.com/1356053WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://www.patreon.com/ferossWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://goo.gl/t5IS6M).WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://crbug.com/110263WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/ChALkeRWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://anglebug.com/42265782WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://example.subWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://127.0.0.1/32WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://github.com/google/pprof/tree/master/protoWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://anglebug.com/42264571forceInitShaderVariablesForce-enableWeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    http://anglebug.com/42266652WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/jrmuizel/qcms/tree/v4WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://chromium.googlesource.com/chromium/src/WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1855131370.0000000007430000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/wesleytodd/setprototypeofWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://crbug.com/593024WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://anglebug.com/42266748WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/tensorflow/modelsWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://anglebug.com/42266745WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/KhronosGroup/SPIRV-Headers.gitWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.npmjs.com/package/safe-buffer)WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://github.com/w3c/ServiceWorker/issues/1356.PropertyWeChat-Setup (3).exe, 00000000.00000003.1854797749.00000000071D6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://anglebug.com/42266740WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://anglebug.com/42263031WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://issuetracker.google.com/161903006WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://127.0.0.1WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://crbug.com/1300575WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://anglebug.com/42266666WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://crbug.com/710443WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://anglebug.com/42263158WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/tensorflow/tflite-supportWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/WICG/scheduling-apisWeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://anglebug.com/42264008WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://pypi.org/project/pyparsingWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://sqlite.org/WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://crbug.com/1060012WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://code.google.com/p/chromium/issues/detail?id=25916WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://github.com/ljharb/qs.gitWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://anglebug.com/42263580disableDrawBuffersIndexedDisableWeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://crbug.com/642605WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://anglebug.com/40096454WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://anglebug.com/42266842uncurrentEglSurfaceUponSurfaceDestroyMakeWeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://tukaani.org/xz/&gt;.WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/joyeecheung/node-dep-codemod#dep005)WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://sizzlejs.com/WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://anglebug.com/345244067WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://anglebug.com/42263049WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://anglebug.com/40644663WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txtWeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://crbug.com/650547callClearTwiceUsingWeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://anglebug.com/42262249WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://anglebug.com/42264669WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://anglebug.com/42265516WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://crbug.com/1420130WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/facebook/react-native/pull/1632WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://www.portaudio.comWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.unicode.org/copyright.htmlWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1745642016.0000000005830000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://anglebug.com/42265636WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://anglebug.com/42265637WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://anglebug.com/42265877WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://issuetracker.google.com/347601787WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://anglebug.com/42266842WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://w3c.github.io/aria/#aria-hidden.WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.WeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/google/shell-encryptionWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://anglebug.com/42266842WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://anglebug.com/42264422WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://anglebug.com/42265995WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://github.com/wasdk/wasmparserWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://anglebug.com/42266725WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://anglebug.com/42262247WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://anglebug.com/42265878WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://anglebug.com/42266602WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://anglebug.com/42265407WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/dpranke/typ.gitWeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://anglebug.com/42266232disableProgramCachingDisablesWeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://issuetracker.google.com/309028728WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://stackoverflow.com/a/16459606/376773WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://anglebug.com/40096758WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://anglebug.com/42263580WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalWeChat-Setup (3).exe, 00000000.00000003.1854797749.0000000006F30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://anglebug.com/42261924allowClearForRobustResourceInitSomeWeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://www.khronos.org/registry/WeChat-Setup (3).exe, 00000000.00000003.1745852459.0000000005D30000.00000004.00001000.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1891159179.00000000051DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://anglebug.com/40096838cacheCompiledShaderEnableWeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://anglebug.com/42266610WeChat-Setup (3).exe, 00000000.00000003.1888602072.00000000051D9000.00000004.00000020.00020000.00000000.sdmp, WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://stackoverflow.com/a/5982798/376773WeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/sponsors/ferossWeChat-Setup (3).exe, 00000000.00000003.1980556048.00000000051D6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://anglebug.com/42262258WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                http://anglebug.com/42265647WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://anglebug.com/42266976WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://anglebug.com/42263239WeChat-Setup (3).exe, 00000000.00000003.1763656750.0000000006B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high

                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                      ⊘No contacted IP infos

                                                                                                                                                                                                      General Information

                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                      Analysis ID:1562678
                                                                                                                                                                                                      Start date and time:2024-11-25 21:42:14 +01:00
                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                      Overall analysis duration:0h 8m 15s
                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                      Number of analysed new started processes analysed:12
                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                      Number of injected processes analysed:1
                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                      Sample name:WeChat-Setup (3).exe
                                                                                                                                                                                                      Detection:SUS
                                                                                                                                                                                                      Classification:sus28.winEXE@8/136@0/0
                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                      • Number of executed functions: 41
                                                                                                                                                                                                      • Number of non-executed functions: 25
                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                      • VT rate limit hit for: WeChat-Setup (3).exe

                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                      15:43:18API Interceptor14x Sleep call for process: WeChat-Setup (3).exe modified
                                                                                                                                                                                                      15:43:59API Interceptor612x Sleep call for process: explorer.exe modified

                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                      IPs

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Domains

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      C:\Users\user\AppData\Local\Programs\wechatapp\d3dcompiler_47.dllG4fDWS1Fpd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        a2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                          kCKthbZCUf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            G4fDWS1Fpd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              a2zZyepQzF.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                kCKthbZCUf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    cMqyGFCQHk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        Soltix.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\LICENSE.electron.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                          MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                          SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                          SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                          SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\LICENSES.chromium.html

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9099045
                                                                                                                                                                                                                          Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                          MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                          SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                          SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                          SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188637696
                                                                                                                                                                                                                          Entropy (8bit):6.760866627383117
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1572864:BRQNRtUqjUXOf2Wbi5xWLY2EYGGbPHaG6iwE7xeeSVJdIgpX+7Rc58VdiHxFxEL9:KB2vNhqn9
                                                                                                                                                                                                                          MD5:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          SHA1:DA7E6EFCBE0E83D634C916758BACC9467CA241DA
                                                                                                                                                                                                                          SHA-256:0A38C610340BEBC06152B59CF3727612C9C7D7B65255A0424146D82BA4DE5C6F
                                                                                                                                                                                                                          SHA-512:C881B2FDBA88776EA70DC14F927859F4FF04ECDBE429F841A88B2897FFA31B47C88696E88C4B87C24DE77211C140FD452E5A35072089AC8EB8F6EF4CFC3AAF5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........."......<G..........KU........@.............................`}...........`..........................................U..k.......h....@l.d....."...H.......... n..6...z......................pu..(....mG.@...........P.......X........................text....;G......<G................. ..`.rdata.. ....PG......BG.............@..@.data....H......L..................@....pdata....H..."...H.................@..@.gxfg....B...Pk..D....,.............@..@.retplne......k.......-..................rodata.......k.......-............. ..`.tls..........k......*-.............@...CPADinfo8.....k......0-.............@...LZMADEC.......k......2-............. ..`_RDATA........l......D-.............@..@malloc_h..... l......F-............. ..`prot.........0l......H-.............@..@.rsrc...d....@l......J-.............@..@.reloc...6... n..8...*/.............@..B................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\chrome_100_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151599
                                                                                                                                                                                                                          Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                          MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                          SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                          SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                          SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\chrome_200_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228644
                                                                                                                                                                                                                          Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                          MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                          SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                          SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                          SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\d3dcompiler_47.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4916728
                                                                                                                                                                                                                          Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                          MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                          SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                          SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                          SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: G4fDWS1Fpd.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: kCKthbZCUf.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: G4fDWS1Fpd.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: a2zZyepQzF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: kCKthbZCUf.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\ffmpeg.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2929152
                                                                                                                                                                                                                          Entropy (8bit):6.70459105395314
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:VGbUZTA3TpECmR7Vye0GH6qfD1vyIdviYxGHW:VGAZ0jmzR7VyevjviT
                                                                                                                                                                                                                          MD5:4EC430319CB353E383879586C0539495
                                                                                                                                                                                                                          SHA1:DC4DDB336A89D422DC9F39E31CBACFE0C313D83E
                                                                                                                                                                                                                          SHA-256:FBAECAF7E583390A6C36997379FADEE0573BC6DDE77A580704B8C54A0D5FD0C8
                                                                                                                                                                                                                          SHA-512:E0FC58E3B8F48391055F86917EE55F98FB0A8FC43D9A93EC20477EA27875A18B62F3E6D601A946B0311662B5E7262FC387BF90F5A20B8D15E36F9020ECF77666
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata.......$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\icudtl.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10468208
                                                                                                                                                                                                                          Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                          MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                          SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                          SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                          SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\libEGL.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):493056
                                                                                                                                                                                                                          Entropy (8bit):6.368202444574794
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:C+DfmCId+wCZGL4UR2R0k3qjD/W86u7x6M62pXSUI89G6Igh/k:Hz/qsUR2Sk3qjj/xxpXSUIG7Btk
                                                                                                                                                                                                                          MD5:968F67578515714F248E11AFCBD62DCB
                                                                                                                                                                                                                          SHA1:EF2CB9A0FA20E7ACFF7D41BB4260F18F43C5909D
                                                                                                                                                                                                                          SHA-256:861036B8CD55F521B0C92A52994BF2BE950177A104D6665981E99584DE61C0C3
                                                                                                                                                                                                                          SHA-512:C6D31D3A63C92704C1532462BEC92B3DD918234ABC1ECA0DC9276F33E80D2F22FD828B6FAF0125780BEBFB027DA85A4EBF0B9A11FD780C91F8BB73A765066238
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." .....l..........p.....................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text...jk.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\libGLESv2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8416768
                                                                                                                                                                                                                          Entropy (8bit):6.5080257584602785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:argJ9y+ALCo+nH/YsLS/gYBPh8ZHZ9ro/TyjaDpA30pzJm+s90p21kHs+3Ep/VGz:DBf9RuTyjCTbxUtGsDWvREX43iCz
                                                                                                                                                                                                                          MD5:F8552B9D1D02B0E740714AB48592962E
                                                                                                                                                                                                                          SHA1:7A375C8BEF79533DB596BA9C3AD26679C61C06C1
                                                                                                                                                                                                                          SHA-256:EAA4CAA6065E2B09B8EF1DC5E6C2DD7C55DC320C97BABA52725CE8F037F1FAD5
                                                                                                                                                                                                                          SHA-512:842215E3B7EEA11B2CB667EF857CE64281E91D1B3BEB99F1D1AA2910C47DDDA0C992F2A81B1CC15AF5088CF116A71454F58CE0A7B4120FD3022768DD87EFCE68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......d...........N......................................`............`A..........................................w.......x.d....p........}..I..................<.w.......................w.(.....d.@.............x.......w.@....................text...5.d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...I....}..J....}.............@..@.gxfg....-...........^..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\resources.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5755347
                                                                                                                                                                                                                          Entropy (8bit):7.996228607315194
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:98304:6Ztti6+Xkrht455GGPeenn04J742LEpxIvMi8rwrGU3nAabpdkmYAzFKwR4:o/ilXkrP455GGHnLEXU8kr1Xddf1FvG
                                                                                                                                                                                                                          MD5:A46D33372052C46E22667C7BC3D537E9
                                                                                                                                                                                                                          SHA1:54E691DA90D50CF61161EAEC9A91F8DA70D1406C
                                                                                                                                                                                                                          SHA-256:9EA49282FD95E162DE5EF293B292ACB958AB21ECB1FA3F61BBFCBF2520E2F6E9
                                                                                                                                                                                                                          SHA-512:C4F600E1216F78D36634BDDA2E7D5A3D53BBA45EDA79109D505A86D026C5333D03FB60BB67A5AB229C7D933C2B2D021231256383BE29241D5438355EAF6EBF7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........B..............................................D@....Dj....D.....D.....D.....D.....D3....D) ...D1$...D.$..HE.$..IE.(..JE.*..SE5/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E2t..aE|y..bE....cE.o..dE.Z..eE.[...E.\...E.m...Epo...E.s...E.v...E.|...E.....E....E.....E.....Ec....E....E^....E.....E.....E?....E.....E.....E:....E.....LA....L.....L.....L3....LX....L.....L0.../Lw...0L=...1L4)..2L.3...Q.D...Q.P...QlY...Q.\...Q._...Q.j...Q.k...Q.l...QIn...Q.....Q.....R.....R....ZdI&..[d*(..\dB=..]d.@..^dxA.._d;D..`d.G..adyI...d.T...d.Y...d%_...d.m...d.p...d]u...d.w...d.x...d.z...d.|...dC....d....6eW...7e....8e...9e@...:e....;e(...<e....=e....>e....?e....@ez...Ae....BeH...Ce.....g{....gl0...g 2.....3.....6.....*....c+.....2.....2.....4.....9.....L....V...........l.....r.....D.....d.................B... .I...<..L..=..M..>..S..?..X..@.nZ..B.hg..C..i..D..s..E..v..F..w..G.t...H.9...I.....J.....K.h...L.$...M.....N.^...O.j...P.W...Q...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\snapshot_blob.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):316538
                                                                                                                                                                                                                          Entropy (8bit):4.177188294389236
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:V+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:VefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                          MD5:1CE550A4309C85E3EE164335F9DADA15
                                                                                                                                                                                                                          SHA1:ACA14A5A88250F39151F1A02691F33076D34190B
                                                                                                                                                                                                                          SHA-256:123ED291DB1620E7940006445D61E402DF02F8C6F855770775BAED3014BE1E0F
                                                                                                                                                                                                                          SHA-512:DF8B224A7EED83F6C6C5CD86D5BA59D9C58DE95AC376255361BE3B44343A9E0858B8C3F1B5AE549983A9897EBF924B901E419D69130091DFA62FEBEE4143E3B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.............._.13.0.245.18-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\uninstallerIcon.ico

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25243
                                                                                                                                                                                                                          Entropy (8bit):7.974044016412984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:qqR8X4VxQyVH8YkDUzwVNz/N4xTvuRLjwWsY5ybjB0teEi4ewhK0h9iPgDbQS:qhIVqyVHX+B5MT2jB8PAeSew1k4bQS
                                                                                                                                                                                                                          MD5:4B2E66FF1AF70DF67EE406053A2CFD65
                                                                                                                                                                                                                          SHA1:CEBFDBEC5DB65DF5B575B9AD90C6DF769DB699D2
                                                                                                                                                                                                                          SHA-256:5D2F734E51B5197F815295A4C78E1DA8C8F76D749AC98F1C53173342D25F7DD6
                                                                                                                                                                                                                          SHA-512:CB444212F0DC2E16BFE56542DCBBD31AFE849F1CFB6119B26EEB3252E32B26B30735C79228034636FDE88BD90C2D8982C3BAB88858BED10F1DA2E536FCDBA957
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............ ..b.......PNG........IHDR.............\r.f..bLIDATx..}w..Wu.....W5.W..d...d..`..t..C... $.....B...0...ab....dI...W.........xm............6w.=.h@....4...h@....4...h@....4...h@....4...h@....4...h@....4...h@....4...h@....4...h@....4...h@....4...h@..PS...Y......b ".."...I....u0....!......M..K)7.G<.GJMa7.`......F.(.I..s.}....i.1....\..T..S][...rJ..{^Ig............z..<-..qZ.\..6)..Rx..O.#.....8.g.qo....DO...q...-.>.`.4r...[.......M.a....X..j>..t...6..?.d..2..X&"p.D..jQ.W. *e...... b..h..1.]..D.I......(.4.|.N......*2...@z..+.6b..+.1..9...s.CB.......]_..3....i...V..a.^(w&%P...R.{...D..';.Pt}`Yb..'I? ..,Dw.j,......,.G|...i7k..O .....I...R...O.'.f....=...}...(.3..t.......INt...nbp.@..Uo.....H.......$l.b&.....cY.m....[......xS..X...R}$.`(L..!ET......3.&...>...mR.o.....r..+.+GO..N.....}<.....HC...5..f.F...h*....p..O.O|B..bk....?..r..'O".lL.-NC.L..@.3Xfd9f'..}r.E.@...>....&..-.r......*\.am..e......Z....i.7.l....A..J.R^.b.K.A.{...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\v8_context_snapshot.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):687473
                                                                                                                                                                                                                          Entropy (8bit):5.155447293350437
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:UPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:UPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                                                                          MD5:06D5F4006D1CCEBA925E46F9917D1143
                                                                                                                                                                                                                          SHA1:0980EC0E9A1A5CFE8B965DEF954A9DBA91C4BD08
                                                                                                                                                                                                                          SHA-256:809D52EF0000014BED63DB8E8F0F51F04343DD2F995C971C9CEC36E07911525C
                                                                                                                                                                                                                          SHA-512:83A370300971295FF5C34A8C1703B82C0DE9C2D81C7DFEC1E2ED1853680A6EDA83EEEBC7D9EA5B349D82D66886CF752E9FA04C6A6E744D0F10B3F7BB375C52AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........].na.13.0.245.18-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\vk_swiftshader.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5532672
                                                                                                                                                                                                                          Entropy (8bit):6.341681073086465
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:5fJg+O2nkm3YqAPkbXSTOEORUvllpRv/Ffi0aFhMUfdJXBS5VN3rdkPTieWowKhG:bi2nkcUZWPQ0Bv5gPB
                                                                                                                                                                                                                          MD5:72DFCAA17A7DB73AE703E972D1769695
                                                                                                                                                                                                                          SHA1:D5A6465FD3C2774AB07C2E8EBDE66F3ED8D0EEAB
                                                                                                                                                                                                                          SHA-256:4B2EFC1D7E795EA2365C08CBFF169BFBD60925FB76931C1B42B9A03C303D5186
                                                                                                                                                                                                                          SHA-512:F99219B6C43B5078B5D73F4F273B32D62DB48E9AEACC5AAAA3B5ECB64505AE6BF4E0E333E00C50C67A4CCE7A796CE3610D4069F18D6C20E7A909657692C60B73
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......B......... .;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...7.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...TR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\vk_swiftshader_icd.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                          MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                          SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                          SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                          SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Programs\wechatapp\vulkan-1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):894976
                                                                                                                                                                                                                          Entropy (8bit):6.60502024085358
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:+WMEq7Zrkss2WWDxcJmtb6Z5WjDYsHy6g3P0zAk7ThXxx9:+WC7dM2WWOJmtb6Z5WjDYsHy6g3P0zAy
                                                                                                                                                                                                                          MD5:B7D9AC2D4B53E8049D6CAE7CC5E6D9AB
                                                                                                                                                                                                                          SHA1:418F4F3CBA006C9A8F99FAA15F19976C9463A0E6
                                                                                                                                                                                                                          SHA-256:36C863D5F03BC393DB8EB313578FB6D8D11B0E63DC7BA8F807034EB59C1350BB
                                                                                                                                                                                                                          SHA-512:C4AC7FF615B49191A9CC35ECDE17E497628B8D7EFB91F32CF988F8C90FC6D0C8692EA922142279F9C2623EB4C9819D39BB623FEC953357DD2EB083181B75856E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ................`~.......................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                          MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                          SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                          SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                          SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9099045
                                                                                                                                                                                                                          Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                          MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                          SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                          SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                          SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\WeChat.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188637696
                                                                                                                                                                                                                          Entropy (8bit):6.760866627383117
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1572864:BRQNRtUqjUXOf2Wbi5xWLY2EYGGbPHaG6iwE7xeeSVJdIgpX+7Rc58VdiHxFxEL9:KB2vNhqn9
                                                                                                                                                                                                                          MD5:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          SHA1:DA7E6EFCBE0E83D634C916758BACC9467CA241DA
                                                                                                                                                                                                                          SHA-256:0A38C610340BEBC06152B59CF3727612C9C7D7B65255A0424146D82BA4DE5C6F
                                                                                                                                                                                                                          SHA-512:C881B2FDBA88776EA70DC14F927859F4FF04ECDBE429F841A88B2897FFA31B47C88696E88C4B87C24DE77211C140FD452E5A35072089AC8EB8F6EF4CFC3AAF5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........."......<G..........KU........@.............................`}...........`..........................................U..k.......h....@l.d....."...H.......... n..6...z......................pu..(....mG.@...........P.......X........................text....;G......<G................. ..`.rdata.. ....PG......BG.............@..@.data....H......L..................@....pdata....H..."...H.................@..@.gxfg....B...Pk..D....,.............@..@.retplne......k.......-..................rodata.......k.......-............. ..`.tls..........k......*-.............@...CPADinfo8.....k......0-.............@...LZMADEC.......k......2-............. ..`_RDATA........l......D-.............@..@malloc_h..... l......F-............. ..`prot.........0l......H-.............@..@.rsrc...d....@l......J-.............@..@.reloc...6... n..8...*/.............@..B................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151599
                                                                                                                                                                                                                          Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                          MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                          SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                          SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                          SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228644
                                                                                                                                                                                                                          Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                          MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                          SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                          SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                          SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4916728
                                                                                                                                                                                                                          Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                          MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                          SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                          SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                          SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2929152
                                                                                                                                                                                                                          Entropy (8bit):6.70459105395314
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:VGbUZTA3TpECmR7Vye0GH6qfD1vyIdviYxGHW:VGAZ0jmzR7VyevjviT
                                                                                                                                                                                                                          MD5:4EC430319CB353E383879586C0539495
                                                                                                                                                                                                                          SHA1:DC4DDB336A89D422DC9F39E31CBACFE0C313D83E
                                                                                                                                                                                                                          SHA-256:FBAECAF7E583390A6C36997379FADEE0573BC6DDE77A580704B8C54A0D5FD0C8
                                                                                                                                                                                                                          SHA-512:E0FC58E3B8F48391055F86917EE55F98FB0A8FC43D9A93EC20477EA27875A18B62F3E6D601A946B0311662B5E7262FC387BF90F5A20B8D15E36F9020ECF77666
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata.......$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10468208
                                                                                                                                                                                                                          Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                          MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                          SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                          SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                          SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):493056
                                                                                                                                                                                                                          Entropy (8bit):6.368202444574794
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:C+DfmCId+wCZGL4UR2R0k3qjD/W86u7x6M62pXSUI89G6Igh/k:Hz/qsUR2Sk3qjj/xxpXSUIG7Btk
                                                                                                                                                                                                                          MD5:968F67578515714F248E11AFCBD62DCB
                                                                                                                                                                                                                          SHA1:EF2CB9A0FA20E7ACFF7D41BB4260F18F43C5909D
                                                                                                                                                                                                                          SHA-256:861036B8CD55F521B0C92A52994BF2BE950177A104D6665981E99584DE61C0C3
                                                                                                                                                                                                                          SHA-512:C6D31D3A63C92704C1532462BEC92B3DD918234ABC1ECA0DC9276F33E80D2F22FD828B6FAF0125780BEBFB027DA85A4EBF0B9A11FD780C91F8BB73A765066238
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." .....l..........p.....................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text...jk.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8416768
                                                                                                                                                                                                                          Entropy (8bit):6.5080257584602785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:argJ9y+ALCo+nH/YsLS/gYBPh8ZHZ9ro/TyjaDpA30pzJm+s90p21kHs+3Ep/VGz:DBf9RuTyjCTbxUtGsDWvREX43iCz
                                                                                                                                                                                                                          MD5:F8552B9D1D02B0E740714AB48592962E
                                                                                                                                                                                                                          SHA1:7A375C8BEF79533DB596BA9C3AD26679C61C06C1
                                                                                                                                                                                                                          SHA-256:EAA4CAA6065E2B09B8EF1DC5E6C2DD7C55DC320C97BABA52725CE8F037F1FAD5
                                                                                                                                                                                                                          SHA-512:842215E3B7EEA11B2CB667EF857CE64281E91D1B3BEB99F1D1AA2910C47DDDA0C992F2A81B1CC15AF5088CF116A71454F58CE0A7B4120FD3022768DD87EFCE68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......d...........N......................................`............`A..........................................w.......x.d....p........}..I..................<.w.......................w.(.....d.@.............x.......w.@....................text...5.d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...I....}..J....}.............@..@.gxfg....-...........^..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):533447
                                                                                                                                                                                                                          Entropy (8bit):5.412082885517651
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                                                                                          MD5:FC32A6B72FC91E1BE9C2C9D2EA586EC3
                                                                                                                                                                                                                          SHA1:5D439600CFF26476D8715B778881F5735356D723
                                                                                                                                                                                                                          SHA-256:C56CB2841EE2E40FBDD6B7E293A1CE74BD10FD500465FCF99D1E07F8D69F8CE7
                                                                                                                                                                                                                          SHA-512:B34C7390D4A15936B1F74F42FA91CCD0CA0587F0DD630096C9A16EC77756E2137D9E49AB1EBBF703C8CE6F56F110D5BB3333B1EBED51779D1BB2460B203A7250
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):861018
                                                                                                                                                                                                                          Entropy (8bit):4.907070191033451
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:9AqToH2hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:9b5N
                                                                                                                                                                                                                          MD5:FECAA68036E19A1E88F0539EFF2F5AB0
                                                                                                                                                                                                                          SHA1:18A30ACEE45BE9EFE78DC9D6949C22DA1A8E9842
                                                                                                                                                                                                                          SHA-256:E300F8C807584487B372873745E721237934DB07A1BD5B0338858FA596510634
                                                                                                                                                                                                                          SHA-512:F20FA785069E80DC6E51DF6F5B324EE18871A0E3068DAFDA030B8ADA99E0944171478C9AE36C7C933BCC537011F7C49FFADF9A47A65F2638B0292227A4BFB1B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):943328
                                                                                                                                                                                                                          Entropy (8bit):4.930662328860223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:NYI8HRGSBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKUt:SNHR2h5aQO
                                                                                                                                                                                                                          MD5:9E4D0C5FD0806743C12FF17C435389F8
                                                                                                                                                                                                                          SHA1:9B16DB1DD032621B4DDD2DC4DD091FE969539E0E
                                                                                                                                                                                                                          SHA-256:F4D0D5D36176CD5FDA9788035E3A152ABFDBB1A2A979F157DE60231034FDB70E
                                                                                                                                                                                                                          SHA-512:EE848FED3AE8F249210043D4E9519E69E7A39B7AC2315A8797365E37317C0743B4CDA7D0001758247432BA41AA70A54D0C0B2A085639D95DA15472E4CD82C1DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):982837
                                                                                                                                                                                                                          Entropy (8bit):4.669921762719658
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                                                                                          MD5:D9D3B4D420BE9277D69584A3C0B5080A
                                                                                                                                                                                                                          SHA1:285A094979B739C4455E3790968D33CA4D466146
                                                                                                                                                                                                                          SHA-256:F08DE6909FAF88465C28388AA03FDF08E165866A5A23C738ED33382275C4EC83
                                                                                                                                                                                                                          SHA-512:388CA1CC11485FD3D31A7FBF710145CBD480CB386D96CF6DFD83E1EF2F5376DF76DB5C2CB051C5A045452875F8362890CBC6DF547200BEC624C9F13636655803
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1267393
                                                                                                                                                                                                                          Entropy (8bit):4.2843443298297235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZISex22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0zpgpCOXqB+iBbD5YqNn
                                                                                                                                                                                                                          MD5:C798CC5946A04209CB601637FDA7E573
                                                                                                                                                                                                                          SHA1:C4A503FE368980D12E097792FA67B76B5934ADE7
                                                                                                                                                                                                                          SHA-256:C48B7423D5638B09860ED1ED4A0741890DC4B3F7C9E682E94867EB8441D196BA
                                                                                                                                                                                                                          SHA-512:7EF077CD66508D47EF4F0E5EC98FD3F18469B66FDD468C9F8EB71E1A960042B12AC9F185FBF598544997CBF7DD7DE5694C7BFD7F8B9D7D5C267BAF81218CCC2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):598906
                                                                                                                                                                                                                          Entropy (8bit):5.409066936914683
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:BVer7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8t2:BVeRVoiL6MhgMNxgQh5cfScs
                                                                                                                                                                                                                          MD5:76A43DB1AF563EB4FB1E9DD6A2969D78
                                                                                                                                                                                                                          SHA1:E2E95FAA86EF9D181C610574ADDB9D1C91E0136C
                                                                                                                                                                                                                          SHA-256:4A94EBB12DA0F50BCBEC55CD354A43D0345A8EA8B0FC5360CF1875098FEDDA25
                                                                                                                                                                                                                          SHA-512:B7A529F2ABC915F0D0F98F57B38814086FE21B3E61BB3EBFD289B5BDCE8BB749608FFAEB0B6225890493214B00410740990A7C16D93B66AA8032AA69021B1B24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):616999
                                                                                                                                                                                                                          Entropy (8bit):5.843780325387443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:863oqX0g5QkuA9jN85ASh6mARAO52C+wH/NOnbJSBXR8QQ:VYmB85AS0P52C+wH/NObJS+
                                                                                                                                                                                                                          MD5:D661BFA360061A0D0F18024CBC00BB6A
                                                                                                                                                                                                                          SHA1:8603B59DC08B8256B242332EFFBC0430677AA8D7
                                                                                                                                                                                                                          SHA-256:690F31ABC263F7C479531B267909777DCB20C680B3CF7801B287860D2415AF3F
                                                                                                                                                                                                                          SHA-512:52C3C82E6F08FE0C2A2CD9B22AA185084D0378F75A6B8BB53D012A1C56A12231540B819724A76AB622A36D9165237299727D1CC0BA49C04C0314BA9BF2CE7E57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):558857
                                                                                                                                                                                                                          Entropy (8bit):5.44951342139458
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:HrL3kV8MmQzVmh5OsfZE1seDrcwlQJWJwgKobwmPaHL95bpkUdRi3jd45FQwA:HtfArYb55bpfdNm
                                                                                                                                                                                                                          MD5:AD05F02DF10D711AC7A301AC8D726543
                                                                                                                                                                                                                          SHA1:FC29975BD36DFF8D30DE0B17FC1656259AD58FB8
                                                                                                                                                                                                                          SHA-256:815B9596DFE002BD6AD6B0F636029B3E693025C499C1FDB09C1FBDF26F8AE4BE
                                                                                                                                                                                                                          SHA-512:D04161BF5EEE41A803ABA8BC4DFED93801E6AF299F8FD6E4589F70447A30CD46739FE223A457B841964B36442746AA6C5B9EC94194CE979A92F673FF011721C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w."...y.I...z.w...|.....}...........................................#.....*.....+.....,...........<.....L.....`.....y...........^.........................................j...........?.....[...........+.....[.....o.................E.....R.................0.....>.................6.....P...........<.....x.................u................., ..... ..... ..... ....j!.....!....>"....X"....."....q#.....#.....#....>$.....$.....$.....$....$%....}%.....%.....%.....%....V&....z&.....&.....&....N'.....'.....'.....'....S(.....(.....(.....(....G)....r).....).....)....&*....L*....V*.....*.....+....<+....J+.....+....E,.....,.....,.....-....[-.....-.....-.....-....8.....V.....n............/....2/....B/...../....*0....d0.....0.....0....S1....x1.....1.....1....^2.....2.....2.....3....P3.....3.....3.....4.....4.....4.....4....m5.....5.....6....J6.....6.....7....F7....X7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):596603
                                                                                                                                                                                                                          Entropy (8bit):5.505955339175374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:55U5D5nPs3K7UpGg5aL9Xtt5fPMkUz1CTz:5enPs3K7UpGg5aLRf53MtCTz
                                                                                                                                                                                                                          MD5:DD811AE7EE2BEB54B60246E8DCD3E212
                                                                                                                                                                                                                          SHA1:967DE04B1C9D98E41DE4AB1C7F73428A2B14D654
                                                                                                                                                                                                                          SHA-256:BE0D49BE3B021C0A4D917AD437D8ED817D676C40BCA4FC08F2F9A8B2CBE67FC3
                                                                                                                                                                                                                          SHA-512:970135C8591F33D978BC705724C1AB42EAD4050B60BFC5315EA47A9E12CE967F2CF6136F863E772C76EF2550AA36544B5AFBAEF215ACC6CDD547D85CF6FF6FAA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076241
                                                                                                                                                                                                                          Entropy (8bit):4.759984538807983
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:y4HcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:NHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                                                                                          MD5:55573EC85A59095CF9D8086963DF6AE4
                                                                                                                                                                                                                          SHA1:C58E9BC0A2BE0E55536916B4BF984568D136192B
                                                                                                                                                                                                                          SHA-256:6807A8DA858659284B951A453B429E16DD91E88B06D54BAEC682F9CB72BDEA3F
                                                                                                                                                                                                                          SHA-512:A6D1212CA9DEF5CE85C89F13D43665E57880CE0F4B490098FB7B9028DA37C629111049414D4D3043547EC519472E4D4777F4151847B1E268BEBE4F3731EF9697
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):485863
                                                                                                                                                                                                                          Entropy (8bit):5.521704610042914
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Ll+Npdwk8sj7ahr7KdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++1J3fMuQSK3Z5MxLG
                                                                                                                                                                                                                          MD5:AFF4D0194020C6B06A71A4C525D4D0B8
                                                                                                                                                                                                                          SHA1:730631BBD0FA0AD45452A19989D0774ECB8FBDFE
                                                                                                                                                                                                                          SHA-256:6D36193855009CFC8C7D83E46B583BA514DDE8E241ABC18DF94AAEE8A95FF735
                                                                                                                                                                                                                          SHA-512:10850E7C03DFF683F047D4685AB5E3D83E57BF2BD941B1E41A381F783879A43221E3872EA31B286656F2656D7EAFD791DDA505AC9AB93C50EF760ECCD3F401E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):490357
                                                                                                                                                                                                                          Entropy (8bit):5.513415827568557
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
                                                                                                                                                                                                                          MD5:A99B6152BDEAC44148F94394C4149622
                                                                                                                                                                                                                          SHA1:DF7371533E92AA24F48469116D9A8AC73249315E
                                                                                                                                                                                                                          SHA-256:75DB989561E145D0D990C4918502316C77CE66B344D3DCE4739E3A6DB43FDE82
                                                                                                                                                                                                                          SHA-512:3160B58D10CA147594FF4ACA004007D4E6823421BE349CFAD945C681E220EEC7266D88434A4D31C719A346650AC0ED31F1F13FCA3E824D81BB65EBB4D21CC2C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):589665
                                                                                                                                                                                                                          Entropy (8bit):5.378803794659303
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:cfKWQ1cE01mlpDYl7G8oZOZ5zazaQ+ax891:cyWQPjpuGS5za9+D1
                                                                                                                                                                                                                          MD5:3B180E08076AE90821F3B305EE5728EC
                                                                                                                                                                                                                          SHA1:690509FA47F843D443C423E0E9B344E4E15BC995
                                                                                                                                                                                                                          SHA-256:0EE595AC6814586B46101E854D01CE6B1076092B07AA2564D6C8ADB5D7A082E6
                                                                                                                                                                                                                          SHA-512:CDB7B852BF9098813B2FBA593FBC9DCC8136C1E643300E4117948FD49DC9F9779EAA99571D36722DACF38F9C71709778618ED271AADAEB3C2F75641B56A3F867
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):589262
                                                                                                                                                                                                                          Entropy (8bit):5.358750479299437
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Uxb0Q3KawPhaJ1WK4G0gkjqpT+ZbBQihXFijs5JEf2D//z/h6PZOkx:SKD24Lep4BQiXijs5+2r/Lzk
                                                                                                                                                                                                                          MD5:956E094FBC7531B2C4738620D7B52F02
                                                                                                                                                                                                                          SHA1:5B9C962A330D92180EF18C7142632D6DBE44AA35
                                                                                                                                                                                                                          SHA-256:DDF9AB7712B96CCED69BAEFBFC315292C073CE5FFF47477B675E08F0F18D5630
                                                                                                                                                                                                                          SHA-512:0744C0B096878E06CBA746B52BCED437D653DFD7B49889FD9094902CE054DBDBB1DE60110C39DD2AE60E8C13BB942EEE2CE7AF602AF93315818EA159C9D861C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):536344
                                                                                                                                                                                                                          Entropy (8bit):5.456025397333951
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:HeaF27VNhXV9RAOrs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN5Ge6Z8+wmFZq0SfH50MIW
                                                                                                                                                                                                                          MD5:ACE748CC20A646162BD473343539D5CE
                                                                                                                                                                                                                          SHA1:D9AEBA3004206B76A1F6B23607281B6484DF76D1
                                                                                                                                                                                                                          SHA-256:9954E80792A5CAC7B0A7AE2899B0ADAA620AF2F3ED2A273EE65B10B22FFA4BBC
                                                                                                                                                                                                                          SHA-512:A9B36941A808C2B93BEB1D3CB4D939CE3333F2F42316B9EB47AD31FBCE85E789230856E43BE1F2660F22677DDBEB192CB492511596EA318A24F158B8C0319571
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):876052
                                                                                                                                                                                                                          Entropy (8bit):5.05122589887934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:UgLujX8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUT:Jus5+v
                                                                                                                                                                                                                          MD5:C99A50512239824AAC4039DD627DA998
                                                                                                                                                                                                                          SHA1:B76801AE3F4F6D000D4F0B8BC0FE388370DFDD65
                                                                                                                                                                                                                          SHA-256:417706E0E5481A26166D3D72B3FC3AA52EB675A59C0531F3C9452D50CFF6E84D
                                                                                                                                                                                                                          SHA-512:ED787C65FDAAA0404EE489A731CE7D392E3F054FB29356BDA0B3DBD4ECE49626631D21AD255F882DB790636189E3A90B876546964D73BFD923F7FE0A659AF140
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........Q(..e.`...h.h...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.@...w.l...y.....z.....|.....}.......B.....G.....O.....W....._.....f.....m.....t.....v.....{...............................................<.........................................%.....N.................#.....J..................................." ....l ..... ....2!.....!....."....;".....".....#.....#.....$.....$....E%.....%.....%....G&.....&....5'....S'.....(.....(....2)....T)....%*.....*....s+.....+.....,.....,.....,.....,....u-..........9.....J...........j/...../...../....Z0.....0....J1...._1.....1.....2.....2.....2....g3.....3....-4....@4.....4....\5.....5.....5....I6.....6....+7....<7.....7.....8.....8.....9.....9.....:....G:....j:.....;.....;.....;..../<.....<....X=.....=.....=.....>....&?....x?.....?....=@.....@.....@.....@.....A....UB.....B.....B....oC.....C....MD....nD....lE....dF.....G....+G.....G.....H.....H...."I.....I.....J.....J.....J....|K.....K....$L....EL.....L.....M.....M.....N

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):547257
                                                                                                                                                                                                                          Entropy (8bit):5.4257939508584885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:sXT/419l5MtWuah5EinUtWnSp0WahHNYM:yTiB5E8nRl
                                                                                                                                                                                                                          MD5:B452982F5D1DC232AC8869217348BB74
                                                                                                                                                                                                                          SHA1:39CFEFDCE0AD7DBBFD72789EEF4835E25D1585F5
                                                                                                                                                                                                                          SHA-256:8D62395944362D437FC1BD7810D8FD037AFCC2F94F56BFAEE4368350C189C106
                                                                                                                                                                                                                          SHA-512:F053285F4341E92A6B06BC019A90C461CB76281C8C5D6B8024F8C15EAA20AC42AD7409B71178CA0B9CB5ADBFAC0216D73B9EB63BF8563F1C9F82C1028A5F5C3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):618874
                                                                                                                                                                                                                          Entropy (8bit):5.2024854226337265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:fGsxIsSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:f7ilx5G7s
                                                                                                                                                                                                                          MD5:D02D3BB645C67A0A3C12F1D174545B48
                                                                                                                                                                                                                          SHA1:6E1AA00C0EB20489AB7E518FAA43F6D3A99EC8F3
                                                                                                                                                                                                                          SHA-256:1A6D121FB42A1B2941F2BC3C11C25E2A7C1E96ED845D08CD5F2370B9D399A0BE
                                                                                                                                                                                                                          SHA-512:5F3AE15A587F7CC2CDB10A4C1535E039517B08D24BCB8ACBADBB2D2B9BA8425C26852A82441A9A32D190E4C06FD83C80B8D06D4226ECC49DC77DD77A67AC717D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):637410
                                                                                                                                                                                                                          Entropy (8bit):5.391423001823023
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1SMTx7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmL:scVYVW45g2
                                                                                                                                                                                                                          MD5:0EE0556F9FD32215FF5A6B64E1A71A59
                                                                                                                                                                                                                          SHA1:8E1C8774DAF341D3B4E541B6BD443F22CB3FBB2E
                                                                                                                                                                                                                          SHA-256:4ABF6CE2DE7F20FFAEED953B97D364F08324BBC9819D2AE02A4AAADCF9B88CFF
                                                                                                                                                                                                                          SHA-512:BA7BC3637A57B26E990C4E23F3F4A3337A5566D0BCBB46238E58EF774605ECC58055CE32BE01584792D5E0A7986FB59138A690D8BFF86CDAEE434CC8D97735A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1247893
                                                                                                                                                                                                                          Entropy (8bit):4.323279138519366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:LtyLn9udlz6IqpIVIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//GQoy2zb/q:cD9DkCyF5qdhX11oG
                                                                                                                                                                                                                          MD5:69B8B51CA26D07C798B8216F51E8E8C9
                                                                                                                                                                                                                          SHA1:A50995B86475799A32CCF48BA92DD736F4175731
                                                                                                                                                                                                                          SHA-256:D0EE25A5A7DEE8337B9DD12E65A5910E75C09AED36EB3ADE0907DE6E14A6D760
                                                                                                                                                                                                                          SHA-512:5BE0C2C91FCD5FB4C45DDC57FA2E07A40EAFCBC9E1EABD29E59AF33B147CAD5A7FFECF4C1E9C05B0282C01939BEC11B13656A8CB299CE286188E2281F7B08E05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.'...l.2...n.:...o.?...p.L...q.R...r.^...s.....t.....v.....w.....y.,...z.Z...|.....}.........................................................................6.....[....................... ...........@.....3...........w.......................n.................5 ..... ..... .....!....."....f"....."....F#.....#....0$....P$....3%.....%....N&.....&.....'.....(....*)....l)....B*.....+.....+.....+.....,....i-.....-.........../.....0.....0.....0.....1.....2.....3.....3....o4.....5....D5....k5....$6.....6.....7....A7.....7.....8.....8.....8.....9....q:.....:.....;.....;....z<.....<.....<.....=....Q>.....>.....>....e?.....@....l@.....@....>A.....A....IB....hB....{C.....D....0E....fE.....F.....F....&G....OG.....G....TH.....H.....H....UI....6J.....J.....J.....K.....L....HM.....M....mN.....O....PO.....O....eP....+Q.....Q.....Q.....R....xS.....T....:T....aU.....V....\W....}W.....X....}Y.....Z....dZ....P[.....\.....\.....\.....]....G^.....^.....^....._.....`....ra

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):769462
                                                                                                                                                                                                                          Entropy (8bit):4.62458091701859
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:i2MtD9IESdhVzCDFVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONn:i2MF935J+f
                                                                                                                                                                                                                          MD5:3EE6AECC3E7FAAB761EE57F73852BC2A
                                                                                                                                                                                                                          SHA1:32374D3E543A57FB7E883B73522314D1958F3401
                                                                                                                                                                                                                          SHA-256:F9E4F3E50D86F0C6FD271CAA160675E224ADB56A292BF21283733E2066A09995
                                                                                                                                                                                                                          SHA-512:298FFC69605C0BF9BD809FA3DDA05769C78EEDE7E39934D8DB71C2362CAB07FE361F21DE9AB6696CEA38399E3F44819EC5A9559151EADE82D65A254BE8E90270
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........v(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i...........................................................................................................&.....H...........F.................]...........P.....p...........x.................n...........-.....>...........!.....P.....r...........m.................t ..... ....B!....f!.....".....".....".....".....#.....#....;$....R$.....$....W%.....%.....%....z&.....'.....'.....'....0(.....(.....(.....(....k).....).....*.....*.....*....:+.....+.....+....$,.....,.....,.....,....l-.....-.... .....5............/....V/....g/...../....O0.....0.....0.....1.....1.....1.....1....z2.....3....R3....q3.....3....Y4.....4.....4....#5.....5.....5.....5....\6.....6.....7....47.....7....G8.....8.....8....<9.....9.....9.....9....P:.....:.....:.....:.....;.....<....b<.....<....Z=.....>.....>.....>....V?.....?.....@....N@.....@....~A.....A.....A....uB.....B.....C....1C.....C....tD.....D

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1316106
                                                                                                                                                                                                                          Entropy (8bit):4.298910546485001
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:69VYzGA0Cy7aLw3cLmIk0G9V/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe1:6PYXHy22cL+0JXp5CKMhqQ
                                                                                                                                                                                                                          MD5:201310438D5483154F0E1CCC9F67FC97
                                                                                                                                                                                                                          SHA1:D59E7117A092DEFF90FC4057AEBB081677C88E82
                                                                                                                                                                                                                          SHA-256:EC8EF41A1EE7CA604CD0F38636E1FDF646C2A7CA560326A98C519961E6386278
                                                                                                                                                                                                                          SHA-512:2DBE93E4E7401F58D6BC2F087A4CD9071B7525F1AB72FCDFF29CD41C1A09D972BA23DB7ED1E1ED4766A488FD2CA77CE732CB015C6E7E8BA5DB05AD3483BD28AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):594995
                                                                                                                                                                                                                          Entropy (8bit):5.5192376579765945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:I44gmOy0YXl+Qv6QyTRw6chThwl57v9YMrbLPDK:IZcucQSFRw6khS5BYAzK
                                                                                                                                                                                                                          MD5:51B515FBC314CE3C9BAD9C4E64380B7C
                                                                                                                                                                                                                          SHA1:46FFD2D0F72EB74066139EDB79AA9AD55EDEF6DD
                                                                                                                                                                                                                          SHA-256:3CA8E7EB09AA20845684BEEFA2351AFD4C6CA95BC09BA8BD7A0B629FE8A40565
                                                                                                                                                                                                                          SHA-512:97F23DB01D5517F5F2DD49BF3D8479EA2F7825A0684FBCF1DECEE49A136CFC0E933F1DD04D2B21EDF2E4A2200EC4A663C38E42E43FA2C1557E709AC010EC8B74
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):640919
                                                                                                                                                                                                                          Entropy (8bit):5.644944304253967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:oeo/GHgmRXxh1Rd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBBHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                                                                                          MD5:85D8BD3516B1965B153236D86B9BCCBC
                                                                                                                                                                                                                          SHA1:996FA6AE823E72E811311C7F4F4FE76CCE686DD6
                                                                                                                                                                                                                          SHA-256:EC81AC981AF0E962654AD4F65030064A6369DC2316CB1B10BB24B473808AD1E9
                                                                                                                                                                                                                          SHA-512:ECAA5210DE1B3E389E5C728FEAD4538DEAE129339F3AA577AEB231E5FDB6C6615C11FE345753559FF491E63F80EB8390893A3576F3061979CE513A8193C3595E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):529396
                                                                                                                                                                                                                          Entropy (8bit):5.379964134408843
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:MB3cv/OGhkV7k+tQqAHcyef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB3c37CV7EqPy2VnjHFbm8At5AVpLp
                                                                                                                                                                                                                          MD5:4394A5418929A04248A93B9AF5F3E7DE
                                                                                                                                                                                                                          SHA1:4FD6C8CA31DC7EBC80133025277E60DD2C116EF3
                                                                                                                                                                                                                          SHA-256:1F5D836E4F4DBB1CF4EE92E388B5B08078CD9B425D9BF472ED2186B05C8EC41F
                                                                                                                                                                                                                          SHA-512:2FA4FD2836F3314B23E03D58B693769D38F7ADA0A0C86201080B5BD2E1D5C61A0BC2D3E6F9F3C4A5403D8A45120997D2F25A74AFE59DA02973463E2AF5F385B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):581014
                                                                                                                                                                                                                          Entropy (8bit):5.296802075489682
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Mkqu5NjNJ21U95Tx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9I:MkALlZm128uJekfzEpe5kLISg
                                                                                                                                                                                                                          MD5:CA196D1CC98D7DA44EFAF626BDC81A60
                                                                                                                                                                                                                          SHA1:7760864AAF7558A8124AC1DFB77C98BB740A5B82
                                                                                                                                                                                                                          SHA-256:225C5653525908AD1601A02F5ADF62F16F6950988B6536DED44E2EDA5D4E8955
                                                                                                                                                                                                                          SHA-512:7AB709301641059868D35EA4CA399995752041AA7F5BCE2A3E13317AF712BAEDA4520CBD10906A94192948AA3A6B9D03983D990A0F92650918C05778C2A2CC49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):708098
                                                                                                                                                                                                                          Entropy (8bit):5.7119992092638325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:SCG5Mw77QW47v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7N47F9ZgQ21Xi5zFLdj
                                                                                                                                                                                                                          MD5:625CB627C3F507EF1BF6D3D64B501BB7
                                                                                                                                                                                                                          SHA1:E758B15B32C4FE8A4306C7ABD4F92FD38CEE1420
                                                                                                                                                                                                                          SHA-256:E50A2CB599A7CE632DED8E0FA8FCC7E9AA3B7D82846071F170908E869B455D89
                                                                                                                                                                                                                          SHA-512:16B137372E40C9B9030788115FBE023E8CD81020FCD995DB170E51A8BCA35AEAE271109FA3AB5ADA2EA9FF75BA626AD60160B9453FD7749C2EE24266894B9FE2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1423981
                                                                                                                                                                                                                          Entropy (8bit):4.241387618091759
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:X3AtGezb4OpsJHVLl6S9AE745LmWA4hqSm2G:5bQ5qWo
                                                                                                                                                                                                                          MD5:134C0822B6935968ED6B5D490FA919C0
                                                                                                                                                                                                                          SHA1:806E9C5125B6659803293E504F6FF5582EA6265C
                                                                                                                                                                                                                          SHA-256:8C67AD8175ABC8DC0588934C4A36B42273878C5DC33E68F679ADD294BEAE9CA6
                                                                                                                                                                                                                          SHA-512:731D7FDB1E84D4A1351B9D04C5EAFC4E896F8C043C0BB3F95262793D4D6CAC2F1F4AD703352A062CCB6D17D22933E125AD83DD280C54139F19A43D380E0486C7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):599182
                                                                                                                                                                                                                          Entropy (8bit):6.077311371669645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Twg3XIFvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULI:TY75vKLCWj
                                                                                                                                                                                                                          MD5:3DF182E73445D378CB7B2F18E87B9773
                                                                                                                                                                                                                          SHA1:69314D1C9144EA1A048E28862B5A09CCBBA1553C
                                                                                                                                                                                                                          SHA-256:FD81B7CE27B720E47BD46A70F3B4B60EE87A22052F58EE4B429B0B59F9AE4B8F
                                                                                                                                                                                                                          SHA-512:7DDF93A820ECC0D037DB8CFEDC9F0420F01DA1B3D05A0FF4153542436B9423CA73067683F059F146B65B17991E6295E889DC66E92C10142C3540FC545DABE72E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):644262
                                                                                                                                                                                                                          Entropy (8bit):5.63564977677677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:kjFt+07S0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0JMnrLZ5sjIjqN
                                                                                                                                                                                                                          MD5:F17350067D1481437BB09810F7DF062E
                                                                                                                                                                                                                          SHA1:B2FADFF14A973EA17A8B1B9462AC989059E05BA4
                                                                                                                                                                                                                          SHA-256:B31B65E81DB7F1F3DAFFAC67B6436039EAD2545F02C428E60AB755AA2630285F
                                                                                                                                                                                                                          SHA-512:B1463705E672B54CD9DEA76756AE3357C1750D9E2FDAD0DFA1799C896417637557F0269F830DAD73C4BE4CEE3564A4021D70BD692345EBACDC6DD9733DF46A8D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):643311
                                                                                                                                                                                                                          Entropy (8bit):5.637264208534794
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Uz9waCt7e5ov28mvsf4xN3tVF89voxEJiiLh/7bOEw5hp1UgFeTE/CoCKbnh2DeS:UbKvNMEpFOEw5pFeTunbf35S
                                                                                                                                                                                                                          MD5:157D4757176A12671E1EAD17E4FC2C1E
                                                                                                                                                                                                                          SHA1:BA783CBE4A80D91F5331CF8C39637530CAF3EE45
                                                                                                                                                                                                                          SHA-256:614E634224D32E39E9A79679D915CE402A6D0106BEE37D39930884F9F6E3E01C
                                                                                                                                                                                                                          SHA-512:FE55263345E043F9A1042B81DF6E5B04698DDF00B462AC51DFF7B3B6E73285315824D63E68A28B5CA236E211E6E04432153051E535315FE7CCD03D9848E02480
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1481376
                                                                                                                                                                                                                          Entropy (8bit):4.274093209238161
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:gtUOGV+75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtu+mGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                                                                                          MD5:8EF6F88631246B1B0EAC82E2D8329D20
                                                                                                                                                                                                                          SHA1:346584AED03DD416FD4F81E3ED6C33004B5EFD35
                                                                                                                                                                                                                          SHA-256:F003A5671D619E6ED42370E70D943EE276012246DFE99310366BC3A70484307A
                                                                                                                                                                                                                          SHA-512:83CC553D2238B83170054D13FA3BDFBA400FA9D55F256F53529B89D69E0370E0C0F9A93AB0AC10592E0D8CC64A3B6F4BED9753E0440FDC0D35D79DC0F8C1733A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1222180
                                                                                                                                                                                                                          Entropy (8bit):4.3006398765924665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:gOG1c9CX6VI4rB1miMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznup6:fG0m4HwcasmKZKbzNvfq1E5imHRen
                                                                                                                                                                                                                          MD5:7D2A82CE8F0F601CAC213B692484DB4D
                                                                                                                                                                                                                          SHA1:FC90EC9C5E3CED11F0EA18EAAD949384B3CDB321
                                                                                                                                                                                                                          SHA-256:0E65A4F22A6A52369F948526D5A3EE3C9BBC99AE23E0B2C414B376BA23C2D411
                                                                                                                                                                                                                          SHA-512:BCE9B80A8AD088AF4D480E1BEAE9D8123CD7772EC0211041B8B537E18757E32EE6446005974596A92B2E7E1CF922D440A926C68C760D06326319107F538A7684
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):554824
                                                                                                                                                                                                                          Entropy (8bit):5.250632390422656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:1fZuPdEaPHfvDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HDsxd2hlWEG95vFG3
                                                                                                                                                                                                                          MD5:9E6EAF18A4406ADF701388F8A1A43BB3
                                                                                                                                                                                                                          SHA1:FA06D4903AD23D67B9B55A54E76B852D2091389E
                                                                                                                                                                                                                          SHA-256:CE4B0390F707E3EC3BCBEFC11CB7B6B914AF50D89B950E16704DFB6D13F0FCA2
                                                                                                                                                                                                                          SHA-512:F14C00AEED38C9ABD356805830279E64C35CAE07FD70C8D1B33F1F39A5E989785FE78B100E30629A74EEA2F208370B1EA1F6319351DF4A6E583E5F0C0B91E384
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):537826
                                                                                                                                                                                                                          Entropy (8bit):5.426161233716447
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ruVkaF73k4oOp7fBpHXYbhOs5wk+bhPLgg5t:MkaRk01YbhOs5f+bFUG
                                                                                                                                                                                                                          MD5:84BB0F7AEC428DC3D18AAA5D95D649F5
                                                                                                                                                                                                                          SHA1:090A7A274F885C7A31C6872CA353000E6E7276B7
                                                                                                                                                                                                                          SHA-256:697882AC2DA78894E449CB1F75DA43E7115C2481BBD2FEE3BDAA425E82FC232C
                                                                                                                                                                                                                          SHA-512:5E92C748BB0B0F8E9605A5E851FE4441399D3CDF12192339C5ED6B707CC7D0B3D7A0131ADD9BAF7D7A83ABB895A415F93BF2472009BEC423D1ED6C59C3E7254B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):556267
                                                                                                                                                                                                                          Entropy (8bit):5.3619644066141
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:jVAW4HolbJ9WQusFUiFgN5tmDdx5btfmzaWDZqqn9pmTy:qW4IlbJ9WQusFU15tmDdx5bFmzaWVqq1
                                                                                                                                                                                                                          MD5:B30726CEEE079C89A5BAE13276E00526
                                                                                                                                                                                                                          SHA1:A616DE06EE7B80B309EF02586C4063FD68DCCB81
                                                                                                                                                                                                                          SHA-256:3A27CFDEF2B79D7A74D18B6E650748DC1E87805255D3155177F5A7D020E0E932
                                                                                                                                                                                                                          SHA-512:3F0F621216B38814EB2E500A2AF0007FC1D58B0797B172FF1AE44D473ED7B9211EAE6BED54FB55D8E1C3F2E4C30EA1DBB081F0C2CD3C9915AF2A88A5EA6541D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):619274
                                                                                                                                                                                                                          Entropy (8bit):5.77081171255827
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ziKEE6WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UAMgmx1QhH1b5FuH4VZy:VmxnMJ1Qh15w
                                                                                                                                                                                                                          MD5:2FA7348A1A79D06A0E19954504752A69
                                                                                                                                                                                                                          SHA1:6C6108D36C9EC617E467A60D3025803E52ECB3AC
                                                                                                                                                                                                                          SHA-256:2AB697892ED2186BDE0CFA3ED27857F850A73B195529F5A4F5A9658DE188EF6A
                                                                                                                                                                                                                          SHA-512:3EE745FA39164AE8D08A531664D0F3D48B42BDF0A4E75542BA18F850AD2C087C7153592FDD588A0FCF9C3131320603441A3DE45170D5B12D64D8D39DB0C3C6C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):581655
                                                                                                                                                                                                                          Entropy (8bit):5.426533223481038
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:mHM4QhMCJisw0NBXBLGfs9y+z5GH8Xun0msRgMpI2:CchHiswI5tXosR9pN
                                                                                                                                                                                                                          MD5:87A7A97ED69F0DB933546CAE395711F3
                                                                                                                                                                                                                          SHA1:5ED3EDCF842473E21B6006AA4F197AC442B05885
                                                                                                                                                                                                                          SHA-256:B4746E095AC2F04A62B6F41FAEF766BA58F1052DCAD9D4130D42F8DB858DFFC3
                                                                                                                                                                                                                          SHA-512:3A879F2629D926C0C7C97B33E088002D7A8D5D5AC1111DE9B4DC60FB8DDBCD0DE57732D2EE654E7E8304C487BA3F1743E7660C9FAA73FD51B230C899B1C3BFE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):585546
                                                                                                                                                                                                                          Entropy (8bit):5.399115428128284
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Edk/CJZzTWJ97ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6kUzTWMMV5+jPSSR7Y
                                                                                                                                                                                                                          MD5:8A9F544654D2BCE716216A2F429BD4A0
                                                                                                                                                                                                                          SHA1:DA4FF555822717C4C074CD9549E07FA70AA4BA98
                                                                                                                                                                                                                          SHA-256:26CB4F9CD46F1BA8ED99C8F326C6A58C4413EE79A04A763A8BD28EE263FAA5AB
                                                                                                                                                                                                                          SHA-512:9BAE30FE834A13BF946B4FD050F2009F3AC4DB68C34D9449A0A610B77799D9D14FBCAE705B8C26EC48077B5D8DEB766C430AA9C3904135E47A879591A05B1900
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):606335
                                                                                                                                                                                                                          Entropy (8bit):5.454066659764432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:kxrPki8XWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrSXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                                                                                          MD5:F9F4DBBF7EF8B266C557230667DA57DF
                                                                                                                                                                                                                          SHA1:375B4CB7B9DECDF88D9604DEFD0EC2BB71976A44
                                                                                                                                                                                                                          SHA-256:CB60090B451122165BB41ABC238318474C4E86A545EEF28AE2790C310C7D0050
                                                                                                                                                                                                                          SHA-512:E667CB46FA9AD15ABEEC1FC30718BB21832233DAB257491827B70BC136162314ED5F51CE5DEBBDBA80AE7183114D297C3E5220D4824EFE4A33BAEA237DE63A1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):996315
                                                                                                                                                                                                                          Entropy (8bit):4.845327761418828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:4I6ofQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4+25H3Oc
                                                                                                                                                                                                                          MD5:26B321E75C9144C51098B03B255BB3D4
                                                                                                                                                                                                                          SHA1:846C87D9DCD3447C67495F65C09394B645FD6A53
                                                                                                                                                                                                                          SHA-256:55FBC29AFCFABF1BA657994E5DC7C5C40837D90A490F01C685907F76383A8782
                                                                                                                                                                                                                          SHA-512:A90EBA7E200F3281A63B2F861005073D4FCB29F18E8F4C9E0401636F3E9423A7E7C415942B8518CF8B4F2B5F1268A5A6D8C803F03A87B6445E316835C285401C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):626605
                                                                                                                                                                                                                          Entropy (8bit):5.81504518947247
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:6fK4vsktDh40i/igVQm5611wYZLtWTjsxt9Wl:6K8xjib5ewsPtIl
                                                                                                                                                                                                                          MD5:4A1099074DDF127479370924850F9596
                                                                                                                                                                                                                          SHA1:B638F9D506D05151148334A8C6A564F3B589349D
                                                                                                                                                                                                                          SHA-256:2F09FF1B8F02F735511F1AC1ECAE5A3E88CD7FE16C58CEE38BEEA5ABA7FB83C9
                                                                                                                                                                                                                          SHA-512:2F1BB9FC1AECD7ED5F3CA217A5BCD3482C699C785604492471E8EB8E2D233BEE3494224FA659A9FC7E7BAB5FBD9A235DB24A7B3E493B9E942DE28840560D1131
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):601837
                                                                                                                                                                                                                          Entropy (8bit):5.489526609579363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:mZQlfcB2z/i1SE5vqfCWJU171i/fzSjqc:m+lBWSE5vqfmi/fzSl
                                                                                                                                                                                                                          MD5:E1FE6B616D7C2149ED10303A0E1B2397
                                                                                                                                                                                                                          SHA1:D115E509B608A11BD0F7CE7420803EFB19ACFC48
                                                                                                                                                                                                                          SHA-256:70457F29ED3790557EF4C9792620C499A9E6134E004C5034586FADEF5A833F6B
                                                                                                                                                                                                                          SHA-512:780567FFCA7C960A9A58E78B755F2CD334D4B1869C523621D8D36495E83BE77EBDBFB90FAA2FB99BF62544343D83DB1F618989425D6EDF4D8B8DC19DEBB70BDB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):924863
                                                                                                                                                                                                                          Entropy (8bit):4.76965221595614
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:nP3ydDCzsexC7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zB4fWt5suBr
                                                                                                                                                                                                                          MD5:C47F0A144F8B336A4CA4A715843D49A9
                                                                                                                                                                                                                          SHA1:764C79D4B9E9D306B4564BE84E0570EFFE8FF3E5
                                                                                                                                                                                                                          SHA-256:77253067454F64D12E56DDF28720A133BEDD5EC7290387BE972B0FC8DE14DCDD
                                                                                                                                                                                                                          SHA-512:6A6A9EBC15618643ED0D95F0345754B0820BC5B8F6990CD7008B8A4D21A3596F7F3C19C50EE86D7B756A1952D7346C78CE6DBCA2931284ECC3B1756F7630F730
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):541022
                                                                                                                                                                                                                          Entropy (8bit):5.539964012177497
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:MnZyPzw0uHrwiT59M1Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgV:i8U7D30Z4KhJW5krMoMo
                                                                                                                                                                                                                          MD5:D290C0E9EA120A793DA7AEB333F9D196
                                                                                                                                                                                                                          SHA1:6FD4F48FC3C7993615CA08FFA0EACBCF3E084154
                                                                                                                                                                                                                          SHA-256:A6905607AC7FF0FBA74D8D401ACCFDAA43D9BBB85AD6CE6D7A02927C846E630E
                                                                                                                                                                                                                          SHA-512:E018F99FEAE292CB92B17CBDFE73585FCC43AEC1BE9DA9CFB4811F4E6B986F93F69E765DA521EA3E5A0743AF1CF60816ACD032C85972AD12FBA37E6E59450CA8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):570564
                                                                                                                                                                                                                          Entropy (8bit):5.341577353322297
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:EvzoOr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evkyv15zsI
                                                                                                                                                                                                                          MD5:AF1FB718BFB3484F5DF40300B777E399
                                                                                                                                                                                                                          SHA1:CCFB3F58A16388448BC9707E7E5CF79A6CF3A838
                                                                                                                                                                                                                          SHA-256:434879A83079FBA562AF9DAC928AD2FCC1033E0A6A5A1F4822D36E710DECDD2B
                                                                                                                                                                                                                          SHA-512:7666C6AEFCF9A7C266E3B2A0144CCD77448CE09D6B7FD2D863D9FF12689E393B5733B2DD577DB853A0775935F176CC1F6EA3E804B11DB14B831271AF4D6F0AEE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1468553
                                                                                                                                                                                                                          Entropy (8bit):4.052667459747012
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:eO7hLhGq5MLs32+LCraKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+e2D1i554sRtRdutm1vYpiMy+
                                                                                                                                                                                                                          MD5:7B03D2E9DCD91CAA8FCD7C38475EB1E0
                                                                                                                                                                                                                          SHA1:6A4E53A3F995AFD5AF8B845850B2F100FB355281
                                                                                                                                                                                                                          SHA-256:8C3E1B39555FD7852EEFDBF8E0D32843605E5B5C3B6770D573A89DBEC7CDEB85
                                                                                                                                                                                                                          SHA-512:1883C030690E962833CBE5F7A68A870577D47EBE5018035153EDD365889722D0D4654BE384B6BE48CDFDD229D992C45B73304B1CA8333DDE212ABF15A2D3DE94
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1359260
                                                                                                                                                                                                                          Entropy (8bit):4.3071627588082215
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1mVy7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBc3p1FPntTitlF2iDk7PgLo:1mms5RNHgy
                                                                                                                                                                                                                          MD5:6DCDD6F3949A07CBBF0ABD731906B9A9
                                                                                                                                                                                                                          SHA1:C793C59A0FC5C13ECEE4BDBB3FF00D0F58DC4C18
                                                                                                                                                                                                                          SHA-256:BDEBBD05CC9CE4DE907ABBE825FEFA57D08F8B983FC2720C56356AEC23634CB2
                                                                                                                                                                                                                          SHA-512:548EC357F87AF98CF068BACDD35AE206BB8B04F531BC11F2B56395AC6462CA7E743D153363F8BFDEE929664E6867544388BCA8002DC34324AAE7E63E6856F163
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1142673
                                                                                                                                                                                                                          Entropy (8bit):4.350579033495036
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:O80Z0XXN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w1Q:OP0a5ANf
                                                                                                                                                                                                                          MD5:631EDF43BB77D016F4AE0BE9E979FFB5
                                                                                                                                                                                                                          SHA1:597783295612E603917EA0B981105267CD902DA9
                                                                                                                                                                                                                          SHA-256:6605217A533A0D0A9060DBD94AB3027762B21CB29C3BF1D2247CA4459D288BB9
                                                                                                                                                                                                                          SHA-512:26F9150757FD6B863E837D1C83C9548B372EE05969999EF4316A538D1BACBE342E5CA908609ACAE1CB2C277314AEEE26567177470C11F4CC1A883C55E0FECA7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........'..e.6...h.>...i.F...j.Q...k.`...l.f...o.n...p.{...q.....r.....s.....t.....v.....w.4...y.[...z.....|.....}.........................".....*...../.....7.....>.....E.....L.....N.....S.....w.................:.....K.....".......................^.............................f.......................[...........N............ ....< ..... ....X!.....!.....!.....".....#.....$.....$....w%.....&.....&.....&.....'....P(.....(.....(.....)....d*.....*.....*.....+....r,.....,.....-....D.....3/...../....10.....1.....1.....1....62.....3.....3.....4....>4.....4.....5.....5.....6.....6.....7.....8....?8.....9.....9....2:....V:....";.....;....C<....j<.....=.....=.....>....->.....?.....?....#@....J@....dA....aB....%C....MC.....D.....D.....D.....E.....E....HF.....F.....F....fG.....G....MH....}H.....I....RJ.....J....XK.....K....mL.....L.....L.....M....:N.....N.....N.....O....IP.....P.....Q.....R.....R.....S.....S.....U.....V.....V...."W.....X.....X....FY....vY....,Z.....Z.....[....>[....G\.....].....]

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):581275
                                                                                                                                                                                                                          Entropy (8bit):5.614418811209825
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:A9d79N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:09Zb8kJ50Jy
                                                                                                                                                                                                                          MD5:4B2AE4045996E28AA7DC340D8EE70672
                                                                                                                                                                                                                          SHA1:B943EE6FB376DF266D8A0D0E8D6BACB337190DFB
                                                                                                                                                                                                                          SHA-256:F2CA71FED0F1C1D8F081ADF740E5A04927890FF35DCCDE1FB2253479B927F93F
                                                                                                                                                                                                                          SHA-512:5703645908EAFAB11503593F4A3B7F3BB278422F32608429CD98B28C5708D2656BF9042F41B3A70AFBD7DCD962A7CAB0476308ABAA987E395270CCF11BA64BA4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):996432
                                                                                                                                                                                                                          Entropy (8bit):4.874097716523002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1xJLTABEpt2I9FGGHWY9TddsSr+whF5gZrZ+dIIXgOb5YB3Ijwl2Ab+rUcauHLNq:3RAypAI9tn75Brm
                                                                                                                                                                                                                          MD5:7A639846A33339B486F485DF1706F3CA
                                                                                                                                                                                                                          SHA1:ECCF7589474B7DA80CBA4670FEF45103B6770EF7
                                                                                                                                                                                                                          SHA-256:843C206AD3FDD6A34D083AE3F969EF58BF3C087DCBA31AF6126FFE46B2726511
                                                                                                                                                                                                                          SHA-512:32FE2D71233D300FA3054E631234194429A7C80BEA879F342EA4EE67B7BC514F697FA618DEB8ED456C0A9A099AF1D17811E621A359E66D4469229C95C8BFD39E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):870809
                                                                                                                                                                                                                          Entropy (8bit):5.161707757912529
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:wtiyilnG/Xo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:VyieKT5/Cgu
                                                                                                                                                                                                                          MD5:E63B8CF9588245F579FCCB8DAE57DAA4
                                                                                                                                                                                                                          SHA1:8638A0B0BCDFDC973B6491F9BDAAF2ECF9C6AC94
                                                                                                                                                                                                                          SHA-256:1929F3C85E550CCCA9985CEF47BE30B690A701CBCA70345BAA0C2AAEE99809F6
                                                                                                                                                                                                                          SHA-512:E7E3EF949B4917F929536F094884149E27D98A13D90A00D81F1FD0E2A67408839705BDD718E17DA6E1228DBE20D63746D7078CA15D2F59A8A37310F1972C04F6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):689418
                                                                                                                                                                                                                          Entropy (8bit):5.790778266082849
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:32HxPY+cGZoEK9VaZLsFK0FnxBxJbTsIxvx5a8h/+cDNUOnmzi0HRva8Z1lc:1+cG6V4sE0RxHZH5a89+yiOnwi01a8ZE
                                                                                                                                                                                                                          MD5:7E8B63AC1207CACA4892722737568983
                                                                                                                                                                                                                          SHA1:81D8AAF528146B58E69635DB579FF62C9560C9E2
                                                                                                                                                                                                                          SHA-256:590C7C9BCCEB61C96B24BCFBACC2B77B02A643E028C838ABBDAC7327A53D63B0
                                                                                                                                                                                                                          SHA-512:5ECDA016A2CA9C4FB72BDF63CC145C580BB67489F1383AD51046E68B55E1FB39C0DDE084CA43080112CDA71F2847E9060FF2F5AB590365F08211DFC450B87468
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........Q(..e.`...h.h...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.O...w.{...y.....z.....|.....}.(.....Q.....V.....^.....f.....n.....u.....|...........................................................Q.................t...........I.....`.......................,...........-.......................A.....g.....s...........I.................4.................0............ .....!....0!.....!....A"....."....."....1#.....#.....#.....$.....$....=%.....%.....%....v&.....'....s'.....'.....(....q(.....(.....(....)).....).....).....)....D*.....*.....*.....+.....+.....+....G,....^,.....,....4-....k-....|-.....-....F.....z.................S/...../...../.....0....x0.....0.....0....t1.....2....z2.....2.....3.....3.....3.....3....X4.....4.....4....a5.....5.....6....-6.....6....j7.....7....!8.....8.....9....:9....\9.....9....Y:.....:.....:....P;.....;.....<....-<.....<....u=.....=.....=.....>....[?.....?.....?....w@.....@.....A.....A.....A.....B....4B....HB.....B....zC.....C.....C

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):496505
                                                                                                                                                                                                                          Entropy (8bit):6.685583535598285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:rr08fzXXcFKw/IzwAEM7i56pz2bHy1t59Lo3/4oT2Paq8lc:XncKwwzwx956pz2bH05Nov4oTUV
                                                                                                                                                                                                                          MD5:03BCA6DF824D1234AC096CE64DA89B02
                                                                                                                                                                                                                          SHA1:CE6C8F91707249631655E6944EE0430FDF33161E
                                                                                                                                                                                                                          SHA-256:7F03B836F3807F6C78D04E440A10B2805C29E588E62FD9A8F9E3835DC1228095
                                                                                                                                                                                                                          SHA-512:CC378D6BE1CF82A2221C3AD612342398A16E9D6B944D2E4C74F872442C8DDA3243AE2DEF098C3EA30072281A3EDE1999C5BFB549D680D8025EA9573E1784CA46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):491017
                                                                                                                                                                                                                          Entropy (8bit):6.696092909020479
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:IpP3caOCdNemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qJgmOWzu0JU52UznUeC
                                                                                                                                                                                                                          MD5:58343AD6ABD20575DF5C085CB4F03E37
                                                                                                                                                                                                                          SHA1:1DB606620CC34F1AA202A9C8C1C8A2FF9A38513D
                                                                                                                                                                                                                          SHA-256:8EC9783009C5BE615D08F9E978BC5AB36EB7DF057030D0DA770A120ADF920933
                                                                                                                                                                                                                          SHA-512:C4DA26AB8BD6836F96817D7B95016EFB9653D6F6D13E2345E14F6662F019A4E72CBA8C8F059C43E0F72DC7491A05D832D23EE457C54D47FCF48515BA4CFF9A8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5755347
                                                                                                                                                                                                                          Entropy (8bit):7.996228607315194
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:98304:6Ztti6+Xkrht455GGPeenn04J742LEpxIvMi8rwrGU3nAabpdkmYAzFKwR4:o/ilXkrP455GGHnLEXU8kr1Xddf1FvG
                                                                                                                                                                                                                          MD5:A46D33372052C46E22667C7BC3D537E9
                                                                                                                                                                                                                          SHA1:54E691DA90D50CF61161EAEC9A91F8DA70D1406C
                                                                                                                                                                                                                          SHA-256:9EA49282FD95E162DE5EF293B292ACB958AB21ECB1FA3F61BBFCBF2520E2F6E9
                                                                                                                                                                                                                          SHA-512:C4F600E1216F78D36634BDDA2E7D5A3D53BBA45EDA79109D505A86D026C5333D03FB60BB67A5AB229C7D933C2B2D021231256383BE29241D5438355EAF6EBF7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........B..............................................D@....Dj....D.....D.....D.....D.....D3....D) ...D1$...D.$..HE.$..IE.(..JE.*..SE5/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E2t..aE|y..bE....cE.o..dE.Z..eE.[...E.\...E.m...Epo...E.s...E.v...E.|...E.....E....E.....E.....Ec....E....E^....E.....E.....E?....E.....E.....E:....E.....LA....L.....L.....L3....LX....L.....L0.../Lw...0L=...1L4)..2L.3...Q.D...Q.P...QlY...Q.\...Q._...Q.j...Q.k...Q.l...QIn...Q.....Q.....R.....R....ZdI&..[d*(..\dB=..]d.@..^dxA.._d;D..`d.G..adyI...d.T...d.Y...d%_...d.m...d.p...d]u...d.w...d.x...d.z...d.|...dC....d....6eW...7e....8e...9e@...:e....;e(...<e....=e....>e....?e....@ez...Ae....BeH...Ce.....g{....gl0...g 2.....3.....6.....*....c+.....2.....2.....4.....9.....L....V...........l.....r.....D.....d.................B... .I...<..L..=..M..>..S..?..X..@.nZ..B.hg..C..i..D..s..E..v..F..w..G.t...H.9...I.....J.....K.h...L.$...M.....N.^...O.j...P.W...Q...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\app-update.yml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):122
                                                                                                                                                                                                                          Entropy (8bit):4.516002043057665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:8tmAKtqWSvoTNFPEPDpSWQn24EVVnBEtNyCHTt:PAK8cT/gDwWQnt8f+H5
                                                                                                                                                                                                                          MD5:50D321810EFF36B75BD1F5E2261D09A5
                                                                                                                                                                                                                          SHA1:5182BA449F22C494C29A52A100BB9346F43A16E2
                                                                                                                                                                                                                          SHA-256:D2A0AF21F43A8825969BA32AF2AAAEA87ADC60BC4C60F62AD9BD7AEA8D0BB28B
                                                                                                                                                                                                                          SHA-512:D013FE3CFA474D321D4E9F69D64855439D7E369D7CDA3FD3723F66F869DD642B0A3B924FAC6B4C75A0B8982057E8E074522FF3F85F6D5C247E0A862F21D343BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:owner: mortint.repo: WeChatApp.provider: github.updaterCacheDirName: wechatapp-updater.publisherName:. - WeChat Official.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4574444
                                                                                                                                                                                                                          Entropy (8bit):5.80125869572056
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:tanNEsRrjT0fwAQTz0UzaBaZ47zdyuZ4TzNjbTUzrXZKTzg7XcewAhSdJww3VeHU:UEwA5JUXb
                                                                                                                                                                                                                          MD5:EC2ECFC1CF81FC7978012C7F13E534A1
                                                                                                                                                                                                                          SHA1:16EE6032384F5F023366E91992BBC3007348FE0F
                                                                                                                                                                                                                          SHA-256:8FFFFB531BF061086D88CACEDAA11700FF37C43B8C400A174C155A3C51CAB110
                                                                                                                                                                                                                          SHA-512:0B05A7ABAE1B63D6D64F85E40767D57118A5558459BD75B9F5122B27062E11B6731EC82C521639ED2F121B4870F31E562C3B19F4155EF8A7A21AFE1F4A26784B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:....LW..HW..CW..{"files":{"main.js":{"size":3398,"integrity":{"algorithm":"SHA256","hash":"a8564ed177b7d33197c9bbd2cbf1075beceb122ad8f1e2a7338a830e3d7b4944","blockSize":4194304,"blocks":["a8564ed177b7d33197c9bbd2cbf1075beceb122ad8f1e2a7338a830e3d7b4944"]},"offset":"0"},"package.json":{"size":502,"integrity":{"algorithm":"SHA256","hash":"1f97ac02f079e9617c3bc5192128614891f003fc534634de028d5ec91c4157db","blockSize":4194304,"blocks":["1f97ac02f079e9617c3bc5192128614891f003fc534634de028d5ec91c4157db"]},"offset":"3398"},"preload.js":{"size":176,"integrity":{"algorithm":"SHA256","hash":"aee9f32843b0acbdda3fb727b7d330342c3a10734d8d653513c2e60b017703dc","blockSize":4194304,"blocks":["aee9f32843b0acbdda3fb727b7d330342c3a10734d8d653513c2e60b017703dc"]},"offset":"3900"},"web":{"files":{"index.html":{"size":591,"integrity":{"algorithm":"SHA256","hash":"6e543a49a9ffabf95d5003c5918f224033638379df7a1d1de0fbd46572738f36","blockSize":4194304,"blocks":["6e543a49a9ffabf95d5003c5918f224033638379df7a1d1de0

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):107520
                                                                                                                                                                                                                          Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                          MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                          SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                          SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                          SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):316538
                                                                                                                                                                                                                          Entropy (8bit):4.177188294389236
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:V+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:VefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                          MD5:1CE550A4309C85E3EE164335F9DADA15
                                                                                                                                                                                                                          SHA1:ACA14A5A88250F39151F1A02691F33076D34190B
                                                                                                                                                                                                                          SHA-256:123ED291DB1620E7940006445D61E402DF02F8C6F855770775BAED3014BE1E0F
                                                                                                                                                                                                                          SHA-512:DF8B224A7EED83F6C6C5CD86D5BA59D9C58DE95AC376255361BE3B44343A9E0858B8C3F1B5AE549983A9897EBF924B901E419D69130091DFA62FEBEE4143E3B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.............._.13.0.245.18-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):687473
                                                                                                                                                                                                                          Entropy (8bit):5.155447293350437
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:UPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:UPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                                                                          MD5:06D5F4006D1CCEBA925E46F9917D1143
                                                                                                                                                                                                                          SHA1:0980EC0E9A1A5CFE8B965DEF954A9DBA91C4BD08
                                                                                                                                                                                                                          SHA-256:809D52EF0000014BED63DB8E8F0F51F04343DD2F995C971C9CEC36E07911525C
                                                                                                                                                                                                                          SHA-512:83A370300971295FF5C34A8C1703B82C0DE9C2D81C7DFEC1E2ED1853680A6EDA83EEEBC7D9EA5B349D82D66886CF752E9FA04C6A6E744D0F10B3F7BB375C52AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........].na.13.0.245.18-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5532672
                                                                                                                                                                                                                          Entropy (8bit):6.341681073086465
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:5fJg+O2nkm3YqAPkbXSTOEORUvllpRv/Ffi0aFhMUfdJXBS5VN3rdkPTieWowKhG:bi2nkcUZWPQ0Bv5gPB
                                                                                                                                                                                                                          MD5:72DFCAA17A7DB73AE703E972D1769695
                                                                                                                                                                                                                          SHA1:D5A6465FD3C2774AB07C2E8EBDE66F3ED8D0EEAB
                                                                                                                                                                                                                          SHA-256:4B2EFC1D7E795EA2365C08CBFF169BFBD60925FB76931C1B42B9A03C303D5186
                                                                                                                                                                                                                          SHA-512:F99219B6C43B5078B5D73F4F273B32D62DB48E9AEACC5AAAA3B5ECB64505AE6BF4E0E333E00C50C67A4CCE7A796CE3610D4069F18D6C20E7A909657692C60B73
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ......B......... .;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...7.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...TR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                          MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                          SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                          SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                          SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):894976
                                                                                                                                                                                                                          Entropy (8bit):6.60502024085358
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:+WMEq7Zrkss2WWDxcJmtb6Z5WjDYsHy6g3P0zAk7ThXxx9:+WC7dM2WWOJmtb6Z5WjDYsHy6g3P0zAy
                                                                                                                                                                                                                          MD5:B7D9AC2D4B53E8049D6CAE7CC5E6D9AB
                                                                                                                                                                                                                          SHA1:418F4F3CBA006C9A8F99FAA15F19976C9463A0E6
                                                                                                                                                                                                                          SHA-256:36C863D5F03BC393DB8EB313578FB6D8D11B0E63DC7BA8F807034EB59C1350BB
                                                                                                                                                                                                                          SHA-512:C4AC7FF615B49191A9CC35ECDE17E497628B8D7EFB91F32CF988F8C90FC6D0C8692EA922142279F9C2623EB4C9819D39BB623FEC953357DD2EB083181B75856E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....)g.........." ................`~.......................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\SpiderBanner.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9216
                                                                                                                                                                                                                          Entropy (8bit):5.5347224014600345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                                                          MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                                                          SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                                                          SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                                                          SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):102400
                                                                                                                                                                                                                          Entropy (8bit):6.729923587623207
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                                                          MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                                                          SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                                                          SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                                                          SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\System.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                          MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                          SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                          SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                          SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\app-64.7z

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):81811729
                                                                                                                                                                                                                          Entropy (8bit):7.999996602984958
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1572864:62/TWarYvq/5sGsc9TI0p7+/gA+FzdN6V9jWlKAh:DkAsr2i/gtd3s9jkh
                                                                                                                                                                                                                          MD5:DA15F4C012DA2313D0530D9CCD32FD6E
                                                                                                                                                                                                                          SHA1:A7906DB2C761B3F238DCB2CF335A40851AC970AA
                                                                                                                                                                                                                          SHA-256:C990972B33931621F4AAC5DEF499D71B45B673564840E52A92EA91B87C837C60
                                                                                                                                                                                                                          SHA-512:043323492FE340CE8151B4C54C9A9DB97E6BAF50D5C4F7F8FE327C8F06691944AD866BFB79A1DA07734C194F1CA92F22DD1EFF6503FB819F2A882F7D091F2E35
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:7z..'...y...X......%........i....]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsExec.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6656
                                                                                                                                                                                                                          Entropy (8bit):5.155286976455086
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                                                                                          MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                                                                                          SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                                                                                          SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                                                                                          SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\nsis7z.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):434176
                                                                                                                                                                                                                          Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                          MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                          SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                          SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                          SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-GB\default.acl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Qn:Qn
                                                                                                                                                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                                                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                                                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                                                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-GB\default.dic

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Qn:Qn
                                                                                                                                                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                                                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                                                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                                                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-GB\default.exc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2
                                                                                                                                                                                                                          Entropy (8bit):1.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Qn:Qn
                                                                                                                                                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                                                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                                                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                                                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\59fea2de-3dad-4f6b-82c6-66f02dad1df8.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):434
                                                                                                                                                                                                                          Entropy (8bit):5.668220957753372
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:YKWSCuj9rrt+2Fik35jy5Fp23/tkCN4pYsNMbVzTD:YKWJu5rrt5L39qp2VkzpYsMbdTD
                                                                                                                                                                                                                          MD5:DA4120971C6C32812B3E740C99B9FBEA
                                                                                                                                                                                                                          SHA1:A1609431AE183EDB020F3D86AA83AD94FB84DF12
                                                                                                                                                                                                                          SHA-256:6F41ADB4BFE6CF081734844D56FA9B535551FB233CD8D35966BC7060BEA95403
                                                                                                                                                                                                                          SHA-512:FA122D1D2B55701D7BEE649C81F39632DBEDAB4E2982821F49283379237BD614EB4CC721CD5CAC9093E91F2CD8B0D2310567198570A2A51D681D214857EF360F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABIBoColOVrR4C44zohZ+T/EAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAB6wT/4vgOIkR1FWA94pkJiTFJU3SEwBVmSSmWPfekZhQAAAAAOgAAAAAIAACAAAAAJemstDZMJhQCShgN/gzvK+0fEa7BooIlJfCVcjwRuGjAAAADI5CFn6CJXNBeyBlDQntLbnMRQGoV9qpptauUHaxFNfW2PV6j37SNDDzzLidMJBfdAAAAACGThi9P0c0SjiQw9ehxKZ6KkVO/w4sh+m+VxfKDT5YKsDq4AAr4TcSS6dTvBTLDGjTaxxgg8DqM31ogE7X1pdg=="}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\72135633-c26a-4622-b38f-ee3aae7a3916.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57
                                                                                                                                                                                                                          Entropy (8bit):4.283088322451805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YWVbSZAjMx/ALfnH4JaGqx41n:YWNlDGn
                                                                                                                                                                                                                          MD5:329622F40165883B656ABAB0D93674C4
                                                                                                                                                                                                                          SHA1:DD0DDF3B58BA7BF841B7664F890C65DC7B20CE87
                                                                                                                                                                                                                          SHA-256:2A2BF0F32B2E88B7394AB518C2EF85880824317076DCE7E932BB8C9B8F218488
                                                                                                                                                                                                                          SHA-512:BF9173F47118D3FD466378CA186B74EFB7481AF15AEABD0BDBA43331721D93F5F9E4D1FD94F38873B8DBA9352D2EB4BF8044A21C52A52409615E3E25894393CF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"spellcheck":{"dictionaries":["en-GB"],"dictionary":""}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\js\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24
                                                                                                                                                                                                                          Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:m+l:m
                                                                                                                                                                                                                          MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                          SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                          SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                          SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:0\r..m..................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\js\index-dir\temp-index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:PMgaE5XM2ln:0M582l
                                                                                                                                                                                                                          MD5:9502AA8D97E757201EF083C393DF54F8
                                                                                                                                                                                                                          SHA1:EDF924C6E866DEB79C011EA6C49E67738C155CB9
                                                                                                                                                                                                                          SHA-256:89487A3FE0F573CD3E631C85FE7860201A40A6C20E16747A1B3662E62E91BC64
                                                                                                                                                                                                                          SHA-512:EE6EC3521DAE10F7DBF45F58945F9D4DA261903718F71ACACA5ACF578ABE178302909E2F8B4723392AAA5C422B16028AD5113DBCF31ABF59BC9278423FFA7106
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(...R)..oy retne..........................B.Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:PMgaE5XM2ln:0M582l
                                                                                                                                                                                                                          MD5:9502AA8D97E757201EF083C393DF54F8
                                                                                                                                                                                                                          SHA1:EDF924C6E866DEB79C011EA6C49E67738C155CB9
                                                                                                                                                                                                                          SHA-256:89487A3FE0F573CD3E631C85FE7860201A40A6C20E16747A1B3662E62E91BC64
                                                                                                                                                                                                                          SHA-512:EE6EC3521DAE10F7DBF45F58945F9D4DA261903718F71ACACA5ACF578ABE178302909E2F8B4723392AAA5C422B16028AD5113DBCF31ABF59BC9278423FFA7106
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(...R)..oy retne..........................B.Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\wasm\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24
                                                                                                                                                                                                                          Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:m+l:m
                                                                                                                                                                                                                          MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                          SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                          SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                          SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:0\r..m..................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:ztiEL9pl:fLrl
                                                                                                                                                                                                                          MD5:D7B619F7161F30FED0F6C7465E847E19
                                                                                                                                                                                                                          SHA1:32A89B6C042B4A9BD3D581A2D287A6C3ECFF3522
                                                                                                                                                                                                                          SHA-256:4DE5024139A196169011D586EA649342B6FD908F87A74B2B3414ECBBE1615AC9
                                                                                                                                                                                                                          SHA-512:FCCD6FF69B75B27BA6EAAF51322FA0695004FA0936EA2E2012A01D82F676C4B3923BAF8F0863EDC663F85E8754C4A9F0DDFC297DD93921BAA34D8C59E1296CCE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(......oy retne..........................B.Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:ztiEL9pl:fLrl
                                                                                                                                                                                                                          MD5:D7B619F7161F30FED0F6C7465E847E19
                                                                                                                                                                                                                          SHA1:32A89B6C042B4A9BD3D581A2D287A6C3ECFF3522
                                                                                                                                                                                                                          SHA-256:4DE5024139A196169011D586EA649342B6FD908F87A74B2B3414ECBBE1615AC9
                                                                                                                                                                                                                          SHA-512:FCCD6FF69B75B27BA6EAAF51322FA0695004FA0936EA2E2012A01D82F676C4B3923BAF8F0863EDC663F85E8754C4A9F0DDFC297DD93921BAA34D8C59E1296CCE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(......oy retne..........................B.Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnGraphiteCache\data_0

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnGraphiteCache\data_1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270336
                                                                                                                                                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnGraphiteCache\data_2

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnGraphiteCache\data_3

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnGraphiteCache\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262512
                                                                                                                                                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:LsNl62t:Ls362
                                                                                                                                                                                                                          MD5:3428535E37503A86372244A1159B8CED
                                                                                                                                                                                                                          SHA1:FD2C2EDF54BCCD3D1E30D829DFE03F9B180EC354
                                                                                                                                                                                                                          SHA-256:125D6C675B16CAB179C6B670A2611AC456FEECC55D2541C3C6497C07FF75A008
                                                                                                                                                                                                                          SHA-512:29F6D59F322EC1B84560C23C803B66CFBAA574284E14CC128001E5D0C619076D895EBF85A13C9CC95298B8708C527375D0E87819A1EA2A98F1C291AA59D5F167
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................c^E.Y./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnWebGPUCache\data_0

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnWebGPUCache\data_1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270336
                                                                                                                                                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnWebGPUCache\data_2

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnWebGPUCache\data_3

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\DawnWebGPUCache\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262512
                                                                                                                                                                                                                          Entropy (8bit):8.736218952347586E-4
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:LsNlfS:Ls3f
                                                                                                                                                                                                                          MD5:275FFDC4BDB4A5A0C2927851C2C7EA24
                                                                                                                                                                                                                          SHA1:6D6053179EDE7C8E2A3B3697A683689FBAE35523
                                                                                                                                                                                                                          SHA-256:9FDBD0039AFE250AA550A3B3A95D57491F532DF6F2A3D5578B3F719577E6064C
                                                                                                                                                                                                                          SHA-512:C59AAAFF80E589E4BD9F423AF8C77B54A538D43A4F551B1042BD62C22B6C9FB40072FEC5E2C73BECC3267B5078CB4EDAFDF9C8C7B6116AE4FFF9F5161F215BF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........................................D.Y./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\GPUCache\data_0

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\GPUCache\data_1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270336
                                                                                                                                                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\GPUCache\data_2

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\GPUCache\data_3

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\GPUCache\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262512
                                                                                                                                                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:LsNl9Cll:Ls39
                                                                                                                                                                                                                          MD5:7BB14BD98521F25269F5E39E58B85E04
                                                                                                                                                                                                                          SHA1:E82285A90776492ACE27B8CDF0102A12D38CA141
                                                                                                                                                                                                                          SHA-256:00E4026261D2CEBCEA6620F252CC71ACA3D01A790B6095863D805A96AAF29C19
                                                                                                                                                                                                                          SHA-512:FFF1FDD8673BF888169518BFBF78155991EDBB358437FBBEA181EBA189E2FED2048F56329AFC1219655768ACE54410B0CA2EBE9E79CCE10A970C9DF34D5A497D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........................................B.Y./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Local State (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):434
                                                                                                                                                                                                                          Entropy (8bit):5.668220957753372
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:YKWSCuj9rrt+2Fik35jy5Fp23/tkCN4pYsNMbVzTD:YKWJu5rrt5L39qp2VkzpYsMbdTD
                                                                                                                                                                                                                          MD5:DA4120971C6C32812B3E740C99B9FBEA
                                                                                                                                                                                                                          SHA1:A1609431AE183EDB020F3D86AA83AD94FB84DF12
                                                                                                                                                                                                                          SHA-256:6F41ADB4BFE6CF081734844D56FA9B535551FB233CD8D35966BC7060BEA95403
                                                                                                                                                                                                                          SHA-512:FA122D1D2B55701D7BEE649C81F39632DBEDAB4E2982821F49283379237BD614EB4CC721CD5CAC9093E91F2CD8B0D2310567198570A2A51D681D214857EF360F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABIBoColOVrR4C44zohZ+T/EAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAB6wT/4vgOIkR1FWA94pkJiTFJU3SEwBVmSSmWPfekZhQAAAAAOgAAAAAIAACAAAAAJemstDZMJhQCShgN/gzvK+0fEa7BooIlJfCVcjwRuGjAAAADI5CFn6CJXNBeyBlDQntLbnMRQGoV9qpptauUHaxFNfW2PV6j37SNDDzzLidMJBfdAAAAACGThi9P0c0SjiQw9ehxKZ6KkVO/w4sh+m+VxfKDT5YKsDq4AAr4TcSS6dTvBTLDGjTaxxgg8DqM31ogE7X1pdg=="}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MANIFEST-000001.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                                                                          Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MANIFEST-000001.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb\LOG

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):245
                                                                                                                                                                                                                          Entropy (8bit):5.298328778566954
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:HApDSXM1wknaZ52n2jM8B2KLlVApDSj2K0Vq2PwknaZ52n2jMGIFUv:gYXrrH2YFLoYj2K0VvYrH2bFUv
                                                                                                                                                                                                                          MD5:382FCC15482F77F84AD715207ABFAC74
                                                                                                                                                                                                                          SHA1:9F87BDBAC369327AB27595CD3EC5D79A711DB819
                                                                                                                                                                                                                          SHA-256:6ED0928369C595B846A4CF53D06AACD978FCBBB65D330AA35EF364A7901E9C60
                                                                                                                                                                                                                          SHA-512:C3D098E50FB4C57470024BFC47DCD5D3910B4C2CEFEC3FD5345CBCEAAFD63BE9DD651B51243ABF1B4A87F4FD81449FC611D28E110A38AE3B08EEB1185B71C58E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:2024/11/25-15:43:41.815 1fd4 Creating DB C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb since it was missing..2024/11/25-15:43:41.977 1fd4 Reusing MANIFEST C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:OpenPGP Secret Key
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):41
                                                                                                                                                                                                                          Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Network\715f8655-bca1-464e-a9be-e3c18491423a.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):59
                                                                                                                                                                                                                          Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
                                                                                                                                                                                                                          MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                          SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                          SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                          SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Network\Network Persistent State (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):59
                                                                                                                                                                                                                          Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
                                                                                                                                                                                                                          MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                          SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                          SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                          SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Network\Trust Tokens

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3046000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36864
                                                                                                                                                                                                                          Entropy (8bit):0.3649935337037638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                                                          MD5:4203ABA60FD9DE5B4232FC624DB3F817
                                                                                                                                                                                                                          SHA1:1F07DFC552D6B509C83C36CB05986007CE29E250
                                                                                                                                                                                                                          SHA-256:19E1E0D60DC0A70455014FEC98B5E4B73E93A80651600368745AB0D4A49C9529
                                                                                                                                                                                                                          SHA-512:6240F8EF505E093F0EA99306ADFA90969B3DE094CDE08B61076BD2C737763C0815108F532EC17E766FE15F9B1BCB9D82096F799EF04D50C3CE2305D8247BFEB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................zp......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Preferences (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57
                                                                                                                                                                                                                          Entropy (8bit):4.283088322451805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YWVbSZAjMx/ALfnH4JaGqx41n:YWNlDGn
                                                                                                                                                                                                                          MD5:329622F40165883B656ABAB0D93674C4
                                                                                                                                                                                                                          SHA1:DD0DDF3B58BA7BF841B7664F890C65DC7B20CE87
                                                                                                                                                                                                                          SHA-256:2A2BF0F32B2E88B7394AB518C2EF85880824317076DCE7E932BB8C9B8F218488
                                                                                                                                                                                                                          SHA-512:BF9173F47118D3FD466378CA186B74EFB7481AF15AEABD0BDBA43331721D93F5F9E4D1FD94F38873B8DBA9352D2EB4BF8044A21C52A52409615E3E25894393CF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"spellcheck":{"dictionaries":["en-GB"],"dictionary":""}}

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Shared Dictionary\cache\index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24
                                                                                                                                                                                                                          Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:m+l:m
                                                                                                                                                                                                                          MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                          SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                          SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                          SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:0\r..m..................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Shared Dictionary\cache\index-dir\temp-index

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:+lNFQyE6R63y+:+lNFw663b
                                                                                                                                                                                                                          MD5:CD2730FC18EEC824616257F8056C0DEC
                                                                                                                                                                                                                          SHA1:DDF86E13D987755638EE6A57B06A14FBC97DF979
                                                                                                                                                                                                                          SHA-256:A8BA89F669D6950897C329AE8EF3BDC958CB18CBD72D21FD8B8B8879BE378929
                                                                                                                                                                                                                          SHA-512:E46FCAC9EE562F81006C1EC821754CE7F89E0031E04117469561C561D7715B5CC8D097BBC0A72AC338563DBAFE38B01C093386F0815EEA8420FA99AEFB704E33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(...#...oy retne........................f4..Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Shared Dictionary\cache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48
                                                                                                                                                                                                                          Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:+lNFQyE6R63y+:+lNFw663b
                                                                                                                                                                                                                          MD5:CD2730FC18EEC824616257F8056C0DEC
                                                                                                                                                                                                                          SHA1:DDF86E13D987755638EE6A57B06A14FBC97DF979
                                                                                                                                                                                                                          SHA-256:A8BA89F669D6950897C329AE8EF3BDC958CB18CBD72D21FD8B8B8879BE378929
                                                                                                                                                                                                                          SHA-512:E46FCAC9EE562F81006C1EC821754CE7F89E0031E04117469561C561D7715B5CC8D097BBC0A72AC338563DBAFE38B01C093386F0815EEA8420FA99AEFB704E33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(...#...oy retne........................f4..Y./.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\WeChat\Shared Dictionary\db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):45056
                                                                                                                                                                                                                          Entropy (8bit):0.429182492880771
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
                                                                                                                                                                                                                          MD5:B581F0FF8F8AA3371AE47B48C95329E8
                                                                                                                                                                                                                          SHA1:4F588EFADF3675F3526CBE762C50EB8E79D9F2E5
                                                                                                                                                                                                                          SHA-256:F8E7CD835195E4EFF7855D20676484CA75F7E7E4FE5B13164FC926B365E1DEA0
                                                                                                                                                                                                                          SHA-512:E0A79452ACB39838AFEA8CE34E05C7E5CDE68F2A786FE4423DDF2588FC6047339E8E4C3140D7E0447F938B2266F52B9DDBDCC0F40C495D833B47B3F27D7996DE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................zp.........g...|.*.../...W............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                          Entropy (8bit):7.9999884999708355
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                          File name:WeChat-Setup (3).exe
                                                                                                                                                                                                                          File size:82'367'982 bytes
                                                                                                                                                                                                                          MD5:565a84e92861a1aa6e96c8b2f95495bb
                                                                                                                                                                                                                          SHA1:0e43a28323124b99f37de8b4ec1230228af8a759
                                                                                                                                                                                                                          SHA256:e4d894b1d5e983b341fcf292ff8302414099f0a5f8eaa07e8a69e9b62332292b
                                                                                                                                                                                                                          SHA512:d5691f456ccab9151d1d2b9f834e9bf3f7b3e01d63a9767ee481ad546e07a4a8e079ccc2fe99939aacfdea62b60c26fae7345c2115cd9982fc3cb74732b9ee29
                                                                                                                                                                                                                          SSDEEP:1572864:Fm2/TWarYvq/5sGsc9TI0p7+/gA+FzdN6V9jWlKAS:FnkAsr2i/gtd3s9jkS
                                                                                                                                                                                                                          TLSH:9D08335407C8CA2AE1D3883F3AFFA371A5B51A2B5310B94B67B9DF1793984F95438063
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:49b8b8ecd4e08769

                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Entrypoint:0x40338f
                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                                          Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                          sub esp, 000002D4h
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          push edi
                                                                                                                                                                                                                          push 00000020h
                                                                                                                                                                                                                          pop edi
                                                                                                                                                                                                                          xor ebx, ebx
                                                                                                                                                                                                                          push 00008001h
                                                                                                                                                                                                                          mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                          mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                          mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                          call dword ptr [004080A8h]
                                                                                                                                                                                                                          call dword ptr [004080A4h]
                                                                                                                                                                                                                          and eax, BFFFFFFFh
                                                                                                                                                                                                                          cmp ax, 00000006h
                                                                                                                                                                                                                          mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                          je 00007F1C1CD31D33h
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          call 00007F1C1CD34FE5h
                                                                                                                                                                                                                          cmp eax, ebx
                                                                                                                                                                                                                          je 00007F1C1CD31D29h
                                                                                                                                                                                                                          push 00000C00h
                                                                                                                                                                                                                          call eax
                                                                                                                                                                                                                          mov esi, 004082B0h
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          call 00007F1C1CD34F5Fh
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          call dword ptr [00408150h]
                                                                                                                                                                                                                          lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                          cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                          jne 00007F1C1CD31D0Ch
                                                                                                                                                                                                                          push 0000000Ah
                                                                                                                                                                                                                          call 00007F1C1CD34FB8h
                                                                                                                                                                                                                          push 00000008h
                                                                                                                                                                                                                          call 00007F1C1CD34FB1h
                                                                                                                                                                                                                          push 00000006h
                                                                                                                                                                                                                          mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                          call 00007F1C1CD34FA5h
                                                                                                                                                                                                                          cmp eax, ebx
                                                                                                                                                                                                                          je 00007F1C1CD31D31h
                                                                                                                                                                                                                          push 0000001Eh
                                                                                                                                                                                                                          call eax
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007F1C1CD31D29h
                                                                                                                                                                                                                          or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                                          call dword ptr [00408044h]
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          call dword ptr [004082A0h]
                                                                                                                                                                                                                          mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                          push 000002B4h
                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          push 00440208h
                                                                                                                                                                                                                          call dword ptr [00408188h]
                                                                                                                                                                                                                          push 0040A2C8h

                                                                                                                                                                                                                          Rich Headers

                                                                                                                                                                                                                          Programming Language:
                                                                                                                                                                                                                          • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x8500.rsrc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                          Sections

                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                          .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .rsrc0x19f0000x85000x86004a4d88f156205a6f13746bfd8ae70fdbFalse0.7953299906716418data7.3092418580205685IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                          Resources

                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                          RT_ICON0x19f4a80x6285PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9957178541691447
                                                                                                                                                                                                                          RT_DIALOG0x1a57300x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                          RT_DIALOG0x1a59380xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                          RT_DIALOG0x1a5a300xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                                                                          RT_DIALOG0x1a5b200x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                                                                          RT_DIALOG0x1a5d200xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                          RT_DIALOG0x1a5e100xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                                                                          RT_DIALOG0x1a5ef80x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                                                                          RT_DIALOG0x1a60e80xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                                                                          RT_DIALOG0x1a61d00xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                                                                          RT_DIALOG0x1a62b00x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                                                                          RT_DIALOG0x1a64a00xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                                                                          RT_DIALOG0x1a65880xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                                                                          RT_DIALOG0x1a66680x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                                                                          RT_DIALOG0x1a68600xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                                                                          RT_DIALOG0x1a69480xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                                                                          RT_DIALOG0x1a6a280x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                                                                          RT_DIALOG0x1a6c300xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                                                                          RT_DIALOG0x1a6d280xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                                                                          RT_GROUP_ICON0x1a6e180x14dataEnglishUnited States1.05
                                                                                                                                                                                                                          RT_VERSION0x1a6e300x2a4dataEnglishUnited States0.4630177514792899
                                                                                                                                                                                                                          RT_MANIFEST0x1a70d80x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                          Imports

                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                          KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                          USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                          GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                          SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                          ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                          COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                          ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                          ⊘No network behavior found

                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:15:43:05
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\WeChat-Setup (3).exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\WeChat-Setup (3).exe"
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          File size:82'367'982 bytes
                                                                                                                                                                                                                          MD5 hash:565A84E92861A1AA6E96C8B2F95495BB
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                          Start time:15:43:39
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff691390000
                                                                                                                                                                                                                          File size:188'637'696 bytes
                                                                                                                                                                                                                          MD5 hash:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                                          Start time:15:43:42
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
                                                                                                                                                                                                                          Imagebase:0x7ff691390000
                                                                                                                                                                                                                          File size:188'637'696 bytes
                                                                                                                                                                                                                          MD5 hash:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:8
                                                                                                                                                                                                                          Start time:15:43:42
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                          Imagebase:0x7ff72b770000
                                                                                                                                                                                                                          File size:5'141'208 bytes
                                                                                                                                                                                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                                          Start time:15:43:46
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --field-trial-handle=3268,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:3
                                                                                                                                                                                                                          Imagebase:0x7ff691390000
                                                                                                                                                                                                                          File size:188'637'696 bytes
                                                                                                                                                                                                                          MD5 hash:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                                          Start time:15:43:48
                                                                                                                                                                                                                          Start date:25/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Programs\wechatapp\WeChat.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\WeChat" --app-path="C:\Users\user\AppData\Local\Programs\wechatapp\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1732562556198562 --launch-time-ticks=4871634903 --field-trial-handle=3412,i,12753569820527524874,9323361878095804256,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3400 --high-entropy-va /prefetch:1
                                                                                                                                                                                                                          Imagebase:0x7ff70f330000
                                                                                                                                                                                                                          File size:188'637'696 bytes
                                                                                                                                                                                                                          MD5 hash:D30F4A09FFEB923F4A05A655600F6BB9
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:27.1%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:20.2%
                                                                                                                                                                                                                            Total number of Nodes:1333
                                                                                                                                                                                                                            Total number of Limit Nodes:35
                                                                                                                                                                                                                            execution_graph 2912 401941 2913 401943 2912->2913 2918 402c41 2913->2918 2919 402c4d 2918->2919 2960 4062dc 2919->2960 2922 401948 2924 4059cc 2922->2924 3002 405c97 2924->3002 2927 4059f4 DeleteFileW 2957 401951 2927->2957 2928 405a0b 2929 405b2b 2928->2929 3016 4062ba lstrcpynW 2928->3016 2929->2957 3045 4065fd FindFirstFileW 2929->3045 2931 405a31 2932 405a44 2931->2932 2933 405a37 lstrcatW 2931->2933 3018 405bdb lstrlenW 2932->3018 2934 405a4a 2933->2934 2937 405a5a lstrcatW 2934->2937 2939 405a65 lstrlenW FindFirstFileW 2934->2939 2937->2939 2939->2929 2949 405a87 2939->2949 2942 405984 5 API calls 2945 405b66 2942->2945 2944 405b0e FindNextFileW 2946 405b24 FindClose 2944->2946 2944->2949 2947 405b80 2945->2947 2948 405b6a 2945->2948 2946->2929 2951 405322 24 API calls 2947->2951 2952 405322 24 API calls 2948->2952 2948->2957 2949->2944 2953 4059cc 60 API calls 2949->2953 2955 405322 24 API calls 2949->2955 3017 4062ba lstrcpynW 2949->3017 3022 405984 2949->3022 3030 405322 2949->3030 3041 406080 MoveFileExW 2949->3041 2951->2957 2954 405b77 2952->2954 2953->2949 2956 406080 36 API calls 2954->2956 2955->2944 2956->2957 2973 4062e9 2960->2973 2961 406534 2962 402c6e 2961->2962 2993 4062ba lstrcpynW 2961->2993 2962->2922 2977 40654e 2962->2977 2964 406502 lstrlenW 2964->2973 2965 4062dc 10 API calls 2965->2964 2968 406417 GetSystemDirectoryW 2968->2973 2970 40642a GetWindowsDirectoryW 2970->2973 2971 40654e 5 API calls 2971->2973 2972 4064a5 lstrcatW 2972->2973 2973->2961 2973->2964 2973->2965 2973->2968 2973->2970 2973->2971 2973->2972 2974 40645e SHGetSpecialFolderLocation 2973->2974 2975 4062dc 10 API calls 2973->2975 2986 406188 2973->2986 2991 406201 wsprintfW 2973->2991 2992 4062ba lstrcpynW 2973->2992 2974->2973 2976 406476 SHGetPathFromIDListW CoTaskMemFree 2974->2976 2975->2973 2976->2973 2980 40655b 2977->2980 2978 4065d1 2979 4065d6 CharPrevW 2978->2979 2983 4065f7 2978->2983 2979->2978 2980->2978 2981 4065c4 CharNextW 2980->2981 2984 4065b0 CharNextW 2980->2984 2985 4065bf CharNextW 2980->2985 2998 405bbc 2980->2998 2981->2978 2981->2980 2983->2922 2984->2980 2985->2981 2994 406127 2986->2994 2989 4061ec 2989->2973 2990 4061bc RegQueryValueExW RegCloseKey 2990->2989 2991->2973 2992->2973 2993->2962 2995 406136 2994->2995 2996 40613a 2995->2996 2997 40613f RegOpenKeyExW 2995->2997 2996->2989 2996->2990 2997->2996 2999 405bc2 2998->2999 3000 405bd8 2999->3000 3001 405bc9 CharNextW 2999->3001 3000->2980 3001->2999 3051 4062ba lstrcpynW 3002->3051 3004 405ca8 3052 405c3a CharNextW CharNextW 3004->3052 3007 4059ec 3007->2927 3007->2928 3008 40654e 5 API calls 3011 405cbe 3008->3011 3009 405cef lstrlenW 3010 405cfa 3009->3010 3009->3011 3012 405b8f 3 API calls 3010->3012 3011->3007 3011->3009 3013 4065fd 2 API calls 3011->3013 3015 405bdb 2 API calls 3011->3015 3014 405cff GetFileAttributesW 3012->3014 3013->3011 3014->3007 3015->3009 3016->2931 3017->2949 3019 405be9 3018->3019 3020 405bfb 3019->3020 3021 405bef CharPrevW 3019->3021 3020->2934 3021->3019 3021->3020 3058 405d8b GetFileAttributesW 3022->3058 3025 4059b1 3025->2949 3026 4059a7 DeleteFileW 3028 4059ad 3026->3028 3027 40599f RemoveDirectoryW 3027->3028 3028->3025 3029 4059bd SetFileAttributesW 3028->3029 3029->3025 3031 40533d 3030->3031 3040 4053df 3030->3040 3032 405359 lstrlenW 3031->3032 3033 4062dc 17 API calls 3031->3033 3034 405382 3032->3034 3035 405367 lstrlenW 3032->3035 3033->3032 3037 405395 3034->3037 3038 405388 SetWindowTextW 3034->3038 3036 405379 lstrcatW 3035->3036 3035->3040 3036->3034 3039 40539b SendMessageW SendMessageW SendMessageW 3037->3039 3037->3040 3038->3037 3039->3040 3040->2949 3042 4060a1 3041->3042 3043 406094 3041->3043 3042->2949 3061 405f06 3043->3061 3046 406613 FindClose 3045->3046 3047 405b50 3045->3047 3046->3047 3047->2957 3048 405b8f lstrlenW CharPrevW 3047->3048 3049 405b5a 3048->3049 3050 405bab lstrcatW 3048->3050 3049->2942 3050->3049 3051->3004 3053 405c57 3052->3053 3056 405c69 3052->3056 3055 405c64 CharNextW 3053->3055 3053->3056 3054 405c8d 3054->3007 3054->3008 3055->3054 3056->3054 3057 405bbc CharNextW 3056->3057 3057->3056 3059 405990 3058->3059 3060 405d9d SetFileAttributesW 3058->3060 3059->3025 3059->3026 3059->3027 3060->3059 3062 405f36 3061->3062 3063 405f5c GetShortPathNameW 3061->3063 3088 405db0 GetFileAttributesW CreateFileW 3062->3088 3065 405f71 3063->3065 3066 40607b 3063->3066 3065->3066 3067 405f79 wsprintfA 3065->3067 3066->3042 3069 4062dc 17 API calls 3067->3069 3068 405f40 CloseHandle GetShortPathNameW 3068->3066 3070 405f54 3068->3070 3071 405fa1 3069->3071 3070->3063 3070->3066 3089 405db0 GetFileAttributesW CreateFileW 3071->3089 3073 405fae 3073->3066 3074 405fbd GetFileSize GlobalAlloc 3073->3074 3075 406074 CloseHandle 3074->3075 3076 405fdf 3074->3076 3075->3066 3090 405e33 ReadFile 3076->3090 3081 406012 3083 405d15 4 API calls 3081->3083 3082 405ffe lstrcpyA 3084 406020 3082->3084 3083->3084 3085 406057 SetFilePointer 3084->3085 3097 405e62 WriteFile 3085->3097 3088->3068 3089->3073 3091 405e51 3090->3091 3091->3075 3092 405d15 lstrlenA 3091->3092 3093 405d56 lstrlenA 3092->3093 3094 405d2f lstrcmpiA 3093->3094 3095 405d5e 3093->3095 3094->3095 3096 405d4d CharNextA 3094->3096 3095->3081 3095->3082 3096->3093 3098 405e80 GlobalFree 3097->3098 3098->3075 3099 4015c1 3100 402c41 17 API calls 3099->3100 3101 4015c8 3100->3101 3102 405c3a 4 API calls 3101->3102 3114 4015d1 3102->3114 3103 401631 3105 401663 3103->3105 3106 401636 3103->3106 3104 405bbc CharNextW 3104->3114 3108 401423 24 API calls 3105->3108 3126 401423 3106->3126 3116 40165b 3108->3116 3113 40164a SetCurrentDirectoryW 3113->3116 3114->3103 3114->3104 3115 401617 GetFileAttributesW 3114->3115 3118 40588b 3114->3118 3121 4057f1 CreateDirectoryW 3114->3121 3130 40586e CreateDirectoryW 3114->3130 3115->3114 3133 406694 GetModuleHandleA 3118->3133 3122 405842 GetLastError 3121->3122 3123 40583e 3121->3123 3122->3123 3124 405851 SetFileSecurityW 3122->3124 3123->3114 3124->3123 3125 405867 GetLastError 3124->3125 3125->3123 3127 405322 24 API calls 3126->3127 3128 401431 3127->3128 3129 4062ba lstrcpynW 3128->3129 3129->3113 3131 405882 GetLastError 3130->3131 3132 40587e 3130->3132 3131->3132 3132->3114 3134 4066b0 3133->3134 3135 4066ba GetProcAddress 3133->3135 3139 406624 GetSystemDirectoryW 3134->3139 3137 405892 3135->3137 3137->3114 3138 4066b6 3138->3135 3138->3137 3140 406646 wsprintfW LoadLibraryExW 3139->3140 3140->3138 3310 401e49 3311 402c1f 17 API calls 3310->3311 3312 401e4f 3311->3312 3313 402c1f 17 API calls 3312->3313 3314 401e5b 3313->3314 3315 401e72 EnableWindow 3314->3315 3316 401e67 ShowWindow 3314->3316 3317 402ac5 3315->3317 3316->3317 3772 40264a 3773 402c1f 17 API calls 3772->3773 3777 402659 3773->3777 3774 4026a3 ReadFile 3774->3777 3784 402796 3774->3784 3775 405e33 ReadFile 3775->3777 3777->3774 3777->3775 3778 4026e3 MultiByteToWideChar 3777->3778 3779 402798 3777->3779 3781 402709 SetFilePointer MultiByteToWideChar 3777->3781 3782 4027a9 3777->3782 3777->3784 3785 405e91 SetFilePointer 3777->3785 3778->3777 3794 406201 wsprintfW 3779->3794 3781->3777 3783 4027ca SetFilePointer 3782->3783 3782->3784 3783->3784 3786 405ead 3785->3786 3787 405ec5 3785->3787 3788 405e33 ReadFile 3786->3788 3787->3777 3789 405eb9 3788->3789 3789->3787 3790 405ef6 SetFilePointer 3789->3790 3791 405ece SetFilePointer 3789->3791 3790->3787 3791->3790 3792 405ed9 3791->3792 3793 405e62 WriteFile 3792->3793 3793->3787 3794->3784 3798 4016cc 3799 402c41 17 API calls 3798->3799 3800 4016d2 GetFullPathNameW 3799->3800 3801 4016ec 3800->3801 3807 40170e 3800->3807 3804 4065fd 2 API calls 3801->3804 3801->3807 3802 401723 GetShortPathNameW 3803 402ac5 3802->3803 3805 4016fe 3804->3805 3805->3807 3808 4062ba lstrcpynW 3805->3808 3807->3802 3807->3803 3808->3807 3809 40234e 3810 402c41 17 API calls 3809->3810 3811 40235d 3810->3811 3812 402c41 17 API calls 3811->3812 3813 402366 3812->3813 3814 402c41 17 API calls 3813->3814 3815 402370 GetPrivateProfileStringW 3814->3815 3598 4038d0 3599 4038e8 3598->3599 3600 4038da CloseHandle 3598->3600 3605 403915 3599->3605 3600->3599 3603 4059cc 67 API calls 3604 4038f9 3603->3604 3606 403923 3605->3606 3607 4038ed 3606->3607 3608 403928 FreeLibrary GlobalFree 3606->3608 3607->3603 3608->3607 3608->3608 3816 401b53 3817 402c41 17 API calls 3816->3817 3818 401b5a 3817->3818 3819 402c1f 17 API calls 3818->3819 3820 401b63 wsprintfW 3819->3820 3821 402ac5 3820->3821 3822 401956 3823 402c41 17 API calls 3822->3823 3824 40195d lstrlenW 3823->3824 3825 402592 3824->3825 3826 4014d7 3827 402c1f 17 API calls 3826->3827 3828 4014dd Sleep 3827->3828 3830 402ac5 3828->3830 3655 403d58 3656 403d70 3655->3656 3657 403eab 3655->3657 3656->3657 3658 403d7c 3656->3658 3659 403efc 3657->3659 3660 403ebc GetDlgItem GetDlgItem 3657->3660 3662 403d87 SetWindowPos 3658->3662 3663 403d9a 3658->3663 3661 403f56 3659->3661 3669 401389 2 API calls 3659->3669 3664 404231 18 API calls 3660->3664 3665 40427d SendMessageW 3661->3665 3686 403ea6 3661->3686 3662->3663 3666 403db7 3663->3666 3667 403d9f ShowWindow 3663->3667 3668 403ee6 KiUserCallbackDispatcher 3664->3668 3698 403f68 3665->3698 3670 403dd9 3666->3670 3671 403dbf DestroyWindow 3666->3671 3667->3666 3672 40140b 2 API calls 3668->3672 3673 403f2e 3669->3673 3674 403dde SetWindowLongW 3670->3674 3675 403def 3670->3675 3725 4041ba 3671->3725 3672->3659 3673->3661 3678 403f32 SendMessageW 3673->3678 3674->3686 3676 403e98 3675->3676 3677 403dfb GetDlgItem 3675->3677 3683 404298 8 API calls 3676->3683 3681 403e2b 3677->3681 3682 403e0e SendMessageW IsWindowEnabled 3677->3682 3678->3686 3679 40140b 2 API calls 3679->3698 3680 4041bc DestroyWindow EndDialog 3680->3725 3685 403e30 3681->3685 3688 403e38 3681->3688 3690 403e7f SendMessageW 3681->3690 3691 403e4b 3681->3691 3682->3681 3682->3686 3683->3686 3684 4041eb ShowWindow 3684->3686 3692 40420a SendMessageW 3685->3692 3687 4062dc 17 API calls 3687->3698 3688->3685 3688->3690 3689 404231 18 API calls 3689->3698 3690->3676 3694 403e53 3691->3694 3695 403e68 3691->3695 3693 403e66 3692->3693 3693->3676 3697 40140b 2 API calls 3694->3697 3696 40140b 2 API calls 3695->3696 3699 403e6f 3696->3699 3697->3685 3698->3679 3698->3680 3698->3686 3698->3687 3698->3689 3700 404231 18 API calls 3698->3700 3716 4040fc DestroyWindow 3698->3716 3699->3676 3699->3685 3701 403fe3 GetDlgItem 3700->3701 3702 404000 ShowWindow KiUserCallbackDispatcher 3701->3702 3703 403ff8 3701->3703 3726 404253 KiUserCallbackDispatcher 3702->3726 3703->3702 3705 40402a EnableWindow 3710 40403e 3705->3710 3706 404043 GetSystemMenu EnableMenuItem SendMessageW 3707 404073 SendMessageW 3706->3707 3706->3710 3707->3710 3709 403d39 18 API calls 3709->3710 3710->3706 3710->3709 3727 404266 SendMessageW 3710->3727 3728 4062ba lstrcpynW 3710->3728 3712 4040a2 lstrlenW 3713 4062dc 17 API calls 3712->3713 3714 4040b8 SetWindowTextW 3713->3714 3715 401389 2 API calls 3714->3715 3715->3698 3717 404116 CreateDialogParamW 3716->3717 3716->3725 3718 404149 3717->3718 3717->3725 3719 404231 18 API calls 3718->3719 3720 404154 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3719->3720 3721 401389 2 API calls 3720->3721 3722 40419a 3721->3722 3722->3686 3723 4041a2 ShowWindow 3722->3723 3724 40427d SendMessageW 3723->3724 3724->3725 3725->3684 3725->3686 3726->3705 3727->3710 3728->3712 3831 401f58 3832 402c41 17 API calls 3831->3832 3833 401f5f 3832->3833 3834 4065fd 2 API calls 3833->3834 3835 401f65 3834->3835 3837 401f76 3835->3837 3838 406201 wsprintfW 3835->3838 3838->3837 3729 402259 3730 402c41 17 API calls 3729->3730 3731 40225f 3730->3731 3732 402c41 17 API calls 3731->3732 3733 402268 3732->3733 3734 402c41 17 API calls 3733->3734 3735 402271 3734->3735 3736 4065fd 2 API calls 3735->3736 3737 40227a 3736->3737 3738 40228b lstrlenW lstrlenW 3737->3738 3739 40227e 3737->3739 3741 405322 24 API calls 3738->3741 3740 405322 24 API calls 3739->3740 3743 402286 3739->3743 3740->3743 3742 4022c9 SHFileOperationW 3741->3742 3742->3739 3742->3743 3839 4046db 3840 404711 3839->3840 3841 4046eb 3839->3841 3843 404298 8 API calls 3840->3843 3842 404231 18 API calls 3841->3842 3844 4046f8 SetDlgItemTextW 3842->3844 3845 40471d 3843->3845 3844->3840 3744 40175c 3745 402c41 17 API calls 3744->3745 3746 401763 3745->3746 3747 405ddf 2 API calls 3746->3747 3748 40176a 3747->3748 3749 405ddf 2 API calls 3748->3749 3749->3748 3846 401d5d GetDlgItem GetClientRect 3847 402c41 17 API calls 3846->3847 3848 401d8f LoadImageW SendMessageW 3847->3848 3849 402ac5 3848->3849 3850 401dad DeleteObject 3848->3850 3850->3849 3851 4022dd 3852 4022e4 3851->3852 3853 4022f7 3851->3853 3854 4062dc 17 API calls 3852->3854 3855 4022f1 3854->3855 3856 405920 MessageBoxIndirectW 3855->3856 3856->3853 3142 405461 3143 405482 GetDlgItem GetDlgItem GetDlgItem 3142->3143 3144 40560b 3142->3144 3188 404266 SendMessageW 3143->3188 3146 405614 GetDlgItem CreateThread CloseHandle 3144->3146 3147 40563c 3144->3147 3146->3147 3211 4053f5 OleInitialize 3146->3211 3149 405667 3147->3149 3150 405653 ShowWindow ShowWindow 3147->3150 3151 40568c 3147->3151 3148 4054f2 3155 4054f9 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3148->3155 3152 405673 3149->3152 3153 4056c7 3149->3153 3193 404266 SendMessageW 3150->3193 3197 404298 3151->3197 3157 4056a1 ShowWindow 3152->3157 3158 40567b 3152->3158 3153->3151 3163 4056d5 SendMessageW 3153->3163 3161 405567 3155->3161 3162 40554b SendMessageW SendMessageW 3155->3162 3159 4056c1 3157->3159 3160 4056b3 3157->3160 3194 40420a 3158->3194 3166 40420a SendMessageW 3159->3166 3165 405322 24 API calls 3160->3165 3167 40557a 3161->3167 3168 40556c SendMessageW 3161->3168 3162->3161 3169 40569a 3163->3169 3170 4056ee CreatePopupMenu 3163->3170 3165->3159 3166->3153 3189 404231 3167->3189 3168->3167 3171 4062dc 17 API calls 3170->3171 3173 4056fe AppendMenuW 3171->3173 3175 40571b GetWindowRect 3173->3175 3176 40572e TrackPopupMenu 3173->3176 3174 40558a 3177 405593 ShowWindow 3174->3177 3178 4055c7 GetDlgItem SendMessageW 3174->3178 3175->3176 3176->3169 3180 405749 3176->3180 3181 4055b6 3177->3181 3182 4055a9 ShowWindow 3177->3182 3178->3169 3179 4055ee SendMessageW SendMessageW 3178->3179 3179->3169 3183 405765 SendMessageW 3180->3183 3192 404266 SendMessageW 3181->3192 3182->3181 3183->3183 3184 405782 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3183->3184 3186 4057a7 SendMessageW 3184->3186 3186->3186 3187 4057d0 GlobalUnlock SetClipboardData CloseClipboard 3186->3187 3187->3169 3188->3148 3190 4062dc 17 API calls 3189->3190 3191 40423c SetDlgItemTextW 3190->3191 3191->3174 3192->3178 3193->3149 3195 404211 3194->3195 3196 404217 SendMessageW 3194->3196 3195->3196 3196->3151 3198 40435b 3197->3198 3199 4042b0 GetWindowLongW 3197->3199 3198->3169 3199->3198 3200 4042c5 3199->3200 3200->3198 3201 4042f2 GetSysColor 3200->3201 3202 4042f5 3200->3202 3201->3202 3203 404305 SetBkMode 3202->3203 3204 4042fb SetTextColor 3202->3204 3205 404323 3203->3205 3206 40431d GetSysColor 3203->3206 3204->3203 3207 404334 3205->3207 3208 40432a SetBkColor 3205->3208 3206->3205 3207->3198 3209 404347 DeleteObject 3207->3209 3210 40434e CreateBrushIndirect 3207->3210 3208->3207 3209->3210 3210->3198 3218 40427d 3211->3218 3213 405418 3217 40543f 3213->3217 3221 401389 3213->3221 3214 40427d SendMessageW 3215 405451 CoUninitialize 3214->3215 3217->3214 3219 404295 3218->3219 3220 404286 SendMessageW 3218->3220 3219->3213 3220->3219 3223 401390 3221->3223 3222 4013fe 3222->3213 3223->3222 3224 4013cb MulDiv SendMessageW 3223->3224 3224->3223 3857 401563 3858 402a6b 3857->3858 3861 406201 wsprintfW 3858->3861 3860 402a70 3861->3860 3225 4023e4 3226 402c41 17 API calls 3225->3226 3227 4023f6 3226->3227 3228 402c41 17 API calls 3227->3228 3229 402400 3228->3229 3242 402cd1 3229->3242 3232 402ac5 3233 402438 3234 402444 3233->3234 3246 402c1f 3233->3246 3237 402463 RegSetValueExW 3234->3237 3249 403116 3234->3249 3235 402c41 17 API calls 3238 40242e lstrlenW 3235->3238 3240 402479 RegCloseKey 3237->3240 3238->3233 3240->3232 3243 402cec 3242->3243 3269 406155 3243->3269 3247 4062dc 17 API calls 3246->3247 3248 402c34 3247->3248 3248->3234 3250 40312f 3249->3250 3251 40315d 3250->3251 3276 403347 SetFilePointer 3250->3276 3273 403331 3251->3273 3255 4032ca 3257 40330c 3255->3257 3262 4032ce 3255->3262 3256 40317a GetTickCount 3258 4032b4 3256->3258 3265 4031c9 3256->3265 3260 403331 ReadFile 3257->3260 3258->3237 3259 403331 ReadFile 3259->3265 3260->3258 3261 403331 ReadFile 3261->3262 3262->3258 3262->3261 3263 405e62 WriteFile 3262->3263 3263->3262 3264 40321f GetTickCount 3264->3265 3265->3258 3265->3259 3265->3264 3266 403244 MulDiv wsprintfW 3265->3266 3268 405e62 WriteFile 3265->3268 3267 405322 24 API calls 3266->3267 3267->3265 3268->3265 3270 406164 3269->3270 3271 402410 3270->3271 3272 40616f RegCreateKeyExW 3270->3272 3271->3232 3271->3233 3271->3235 3272->3271 3274 405e33 ReadFile 3273->3274 3275 403168 3274->3275 3275->3255 3275->3256 3275->3258 3276->3251 3862 404367 lstrcpynW lstrlenW 3863 401968 3864 402c1f 17 API calls 3863->3864 3865 40196f 3864->3865 3866 402c1f 17 API calls 3865->3866 3867 40197c 3866->3867 3868 402c41 17 API calls 3867->3868 3869 401993 lstrlenW 3868->3869 3870 4019a4 3869->3870 3871 4019e5 3870->3871 3875 4062ba lstrcpynW 3870->3875 3873 4019d5 3873->3871 3874 4019da lstrlenW 3873->3874 3874->3871 3875->3873 3876 402868 3877 402c41 17 API calls 3876->3877 3878 40286f FindFirstFileW 3877->3878 3879 402882 3878->3879 3880 402897 3878->3880 3884 406201 wsprintfW 3880->3884 3882 4028a0 3885 4062ba lstrcpynW 3882->3885 3884->3882 3885->3879 3886 403968 3887 403973 3886->3887 3888 403977 3887->3888 3889 40397a GlobalAlloc 3887->3889 3889->3888 3890 40166a 3891 402c41 17 API calls 3890->3891 3892 401670 3891->3892 3893 4065fd 2 API calls 3892->3893 3894 401676 3893->3894 3318 40176f 3319 402c41 17 API calls 3318->3319 3320 401776 3319->3320 3321 401796 3320->3321 3322 40179e 3320->3322 3357 4062ba lstrcpynW 3321->3357 3358 4062ba lstrcpynW 3322->3358 3325 40179c 3329 40654e 5 API calls 3325->3329 3326 4017a9 3327 405b8f 3 API calls 3326->3327 3328 4017af lstrcatW 3327->3328 3328->3325 3347 4017bb 3329->3347 3330 4065fd 2 API calls 3330->3347 3331 405d8b 2 API calls 3331->3347 3333 4017cd CompareFileTime 3333->3347 3334 40188d 3336 405322 24 API calls 3334->3336 3335 401864 3337 405322 24 API calls 3335->3337 3346 401879 3335->3346 3338 401897 3336->3338 3337->3346 3339 403116 31 API calls 3338->3339 3341 4018aa 3339->3341 3340 4062ba lstrcpynW 3340->3347 3342 4018be SetFileTime 3341->3342 3344 4018d0 CloseHandle 3341->3344 3342->3344 3343 4062dc 17 API calls 3343->3347 3345 4018e1 3344->3345 3344->3346 3348 4018e6 3345->3348 3349 4018f9 3345->3349 3347->3330 3347->3331 3347->3333 3347->3334 3347->3335 3347->3340 3347->3343 3356 405db0 GetFileAttributesW CreateFileW 3347->3356 3359 405920 3347->3359 3350 4062dc 17 API calls 3348->3350 3351 4062dc 17 API calls 3349->3351 3352 4018ee lstrcatW 3350->3352 3353 401901 3351->3353 3352->3353 3355 405920 MessageBoxIndirectW 3353->3355 3355->3346 3356->3347 3357->3325 3358->3326 3360 405935 3359->3360 3361 405981 3360->3361 3362 405949 MessageBoxIndirectW 3360->3362 3361->3347 3362->3361 3895 4027ef 3896 4027f6 3895->3896 3899 402a70 3895->3899 3897 402c1f 17 API calls 3896->3897 3898 4027fd 3897->3898 3900 40280c SetFilePointer 3898->3900 3900->3899 3901 40281c 3900->3901 3903 406201 wsprintfW 3901->3903 3903->3899 3904 4043f0 3905 404408 3904->3905 3909 404522 3904->3909 3910 404231 18 API calls 3905->3910 3906 40458c 3907 404656 3906->3907 3908 404596 GetDlgItem 3906->3908 3915 404298 8 API calls 3907->3915 3911 4045b0 3908->3911 3912 404617 3908->3912 3909->3906 3909->3907 3913 40455d GetDlgItem SendMessageW 3909->3913 3914 40446f 3910->3914 3911->3912 3918 4045d6 SendMessageW LoadCursorW SetCursor 3911->3918 3912->3907 3919 404629 3912->3919 3937 404253 KiUserCallbackDispatcher 3913->3937 3917 404231 18 API calls 3914->3917 3925 404651 3915->3925 3921 40447c CheckDlgButton 3917->3921 3941 40469f 3918->3941 3923 40463f 3919->3923 3924 40462f SendMessageW 3919->3924 3920 404587 3938 40467b 3920->3938 3935 404253 KiUserCallbackDispatcher 3921->3935 3923->3925 3926 404645 SendMessageW 3923->3926 3924->3923 3926->3925 3930 40449a GetDlgItem 3936 404266 SendMessageW 3930->3936 3932 4044b0 SendMessageW 3933 4044d6 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3932->3933 3934 4044cd GetSysColor 3932->3934 3933->3925 3934->3933 3935->3930 3936->3932 3937->3920 3939 404689 3938->3939 3940 40468e SendMessageW 3938->3940 3939->3940 3940->3906 3944 4058e6 ShellExecuteExW 3941->3944 3943 404605 LoadCursorW SetCursor 3943->3912 3944->3943 3945 401a72 3946 402c1f 17 API calls 3945->3946 3947 401a7b 3946->3947 3948 402c1f 17 API calls 3947->3948 3949 401a20 3948->3949 3950 401573 3951 401583 ShowWindow 3950->3951 3952 40158c 3950->3952 3951->3952 3953 40159a ShowWindow 3952->3953 3954 402ac5 3952->3954 3953->3954 3955 402df3 3956 402e05 SetTimer 3955->3956 3957 402e1e 3955->3957 3956->3957 3958 402e73 3957->3958 3959 402e38 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 3957->3959 3959->3958 3960 401cf3 3961 402c1f 17 API calls 3960->3961 3962 401cf9 IsWindow 3961->3962 3963 401a20 3962->3963 3964 4014f5 SetForegroundWindow 3965 402ac5 3964->3965 3966 402576 3967 402c41 17 API calls 3966->3967 3968 40257d 3967->3968 3971 405db0 GetFileAttributesW CreateFileW 3968->3971 3970 402589 3971->3970 3632 401b77 3633 401bc8 3632->3633 3635 401b84 3632->3635 3636 401bf2 GlobalAlloc 3633->3636 3637 401bcd 3633->3637 3634 4022e4 3639 4062dc 17 API calls 3634->3639 3635->3634 3641 401b9b 3635->3641 3638 4062dc 17 API calls 3636->3638 3647 401c0d 3637->3647 3651 4062ba lstrcpynW 3637->3651 3638->3647 3640 4022f1 3639->3640 3645 405920 MessageBoxIndirectW 3640->3645 3652 4062ba lstrcpynW 3641->3652 3644 401bdf GlobalFree 3644->3647 3645->3647 3646 401baa 3653 4062ba lstrcpynW 3646->3653 3649 401bb9 3654 4062ba lstrcpynW 3649->3654 3651->3644 3652->3646 3653->3649 3654->3647 3972 404a78 3973 404aa4 3972->3973 3974 404a88 3972->3974 3976 404ad7 3973->3976 3977 404aaa SHGetPathFromIDListW 3973->3977 3983 405904 GetDlgItemTextW 3974->3983 3979 404ac1 SendMessageW 3977->3979 3980 404aba 3977->3980 3978 404a95 SendMessageW 3978->3973 3979->3976 3982 40140b 2 API calls 3980->3982 3982->3979 3983->3978 3984 4024f8 3985 402c81 17 API calls 3984->3985 3986 402502 3985->3986 3987 402c1f 17 API calls 3986->3987 3988 40250b 3987->3988 3989 402533 RegEnumValueW 3988->3989 3990 402527 RegEnumKeyW 3988->3990 3992 40288b 3988->3992 3991 402548 RegCloseKey 3989->3991 3990->3991 3991->3992 3994 40167b 3995 402c41 17 API calls 3994->3995 3996 401682 3995->3996 3997 402c41 17 API calls 3996->3997 3998 40168b 3997->3998 3999 402c41 17 API calls 3998->3999 4000 401694 MoveFileW 3999->4000 4001 4016a7 4000->4001 4007 4016a0 4000->4007 4003 4065fd 2 API calls 4001->4003 4005 402250 4001->4005 4002 401423 24 API calls 4002->4005 4004 4016b6 4003->4004 4004->4005 4006 406080 36 API calls 4004->4006 4006->4007 4007->4002 4008 401e7d 4009 402c41 17 API calls 4008->4009 4010 401e83 4009->4010 4011 402c41 17 API calls 4010->4011 4012 401e8c 4011->4012 4013 402c41 17 API calls 4012->4013 4014 401e95 4013->4014 4015 402c41 17 API calls 4014->4015 4016 401e9e 4015->4016 4017 401423 24 API calls 4016->4017 4018 401ea5 4017->4018 4025 4058e6 ShellExecuteExW 4018->4025 4020 401ee7 4023 40288b 4020->4023 4026 406745 WaitForSingleObject 4020->4026 4022 401f01 CloseHandle 4022->4023 4025->4020 4027 40675f 4026->4027 4028 406771 GetExitCodeProcess 4027->4028 4029 4066d0 2 API calls 4027->4029 4028->4022 4030 406766 WaitForSingleObject 4029->4030 4030->4027 4031 4019ff 4032 402c41 17 API calls 4031->4032 4033 401a06 4032->4033 4034 402c41 17 API calls 4033->4034 4035 401a0f 4034->4035 4036 401a16 lstrcmpiW 4035->4036 4037 401a28 lstrcmpW 4035->4037 4038 401a1c 4036->4038 4037->4038 4039 401000 4040 401037 BeginPaint GetClientRect 4039->4040 4041 40100c DefWindowProcW 4039->4041 4043 4010f3 4040->4043 4044 401179 4041->4044 4045 401073 CreateBrushIndirect FillRect DeleteObject 4043->4045 4046 4010fc 4043->4046 4045->4043 4047 401102 CreateFontIndirectW 4046->4047 4048 401167 EndPaint 4046->4048 4047->4048 4049 401112 6 API calls 4047->4049 4048->4044 4049->4048 4050 401503 4051 40150b 4050->4051 4053 40151e 4050->4053 4052 402c1f 17 API calls 4051->4052 4052->4053 3277 402104 3278 402c41 17 API calls 3277->3278 3279 40210b 3278->3279 3280 402c41 17 API calls 3279->3280 3281 402115 3280->3281 3282 402c41 17 API calls 3281->3282 3283 40211f 3282->3283 3284 402c41 17 API calls 3283->3284 3285 402129 3284->3285 3286 402c41 17 API calls 3285->3286 3288 402133 3286->3288 3287 402172 CoCreateInstance 3292 402191 3287->3292 3288->3287 3289 402c41 17 API calls 3288->3289 3289->3287 3290 401423 24 API calls 3291 402250 3290->3291 3292->3290 3292->3291 3293 402484 3304 402c81 3293->3304 3296 402c41 17 API calls 3297 402497 3296->3297 3298 4024a2 RegQueryValueExW 3297->3298 3299 40288b 3297->3299 3300 4024c2 3298->3300 3301 4024c8 RegCloseKey 3298->3301 3300->3301 3309 406201 wsprintfW 3300->3309 3301->3299 3305 402c41 17 API calls 3304->3305 3306 402c98 3305->3306 3307 406127 RegOpenKeyExW 3306->3307 3308 40248e 3307->3308 3308->3296 3309->3301 4054 401f06 4055 402c41 17 API calls 4054->4055 4056 401f0c 4055->4056 4057 405322 24 API calls 4056->4057 4058 401f16 4057->4058 4059 4058a3 2 API calls 4058->4059 4060 401f1c 4059->4060 4061 401f3f CloseHandle 4060->4061 4062 40288b 4060->4062 4063 406745 5 API calls 4060->4063 4061->4062 4065 401f31 4063->4065 4065->4061 4067 406201 wsprintfW 4065->4067 4067->4061 4068 40190c 4069 401943 4068->4069 4070 402c41 17 API calls 4069->4070 4071 401948 4070->4071 4072 4059cc 67 API calls 4071->4072 4073 401951 4072->4073 4074 40230c 4075 402314 4074->4075 4077 40231a 4074->4077 4076 402c41 17 API calls 4075->4076 4076->4077 4078 402328 4077->4078 4080 402c41 17 API calls 4077->4080 4079 402336 4078->4079 4081 402c41 17 API calls 4078->4081 4082 402c41 17 API calls 4079->4082 4080->4078 4081->4079 4083 40233f WritePrivateProfileStringW 4082->4083 4084 401f8c 4085 402c41 17 API calls 4084->4085 4086 401f93 4085->4086 4087 406694 5 API calls 4086->4087 4088 401fa2 4087->4088 4089 402026 4088->4089 4090 401fbe GlobalAlloc 4088->4090 4090->4089 4091 401fd2 4090->4091 4092 406694 5 API calls 4091->4092 4093 401fd9 4092->4093 4094 406694 5 API calls 4093->4094 4095 401fe3 4094->4095 4095->4089 4099 406201 wsprintfW 4095->4099 4097 402018 4100 406201 wsprintfW 4097->4100 4099->4097 4100->4089 4101 40238e 4102 4023c1 4101->4102 4103 402396 4101->4103 4105 402c41 17 API calls 4102->4105 4104 402c81 17 API calls 4103->4104 4107 40239d 4104->4107 4106 4023c8 4105->4106 4112 402cff 4106->4112 4109 4023d5 4107->4109 4110 402c41 17 API calls 4107->4110 4111 4023ae RegDeleteValueW RegCloseKey 4110->4111 4111->4109 4113 402d13 4112->4113 4115 402d0c 4112->4115 4113->4115 4116 402d44 4113->4116 4115->4109 4117 406127 RegOpenKeyExW 4116->4117 4118 402d72 4117->4118 4119 402d98 RegEnumKeyW 4118->4119 4120 402daf RegCloseKey 4118->4120 4121 402dd0 RegCloseKey 4118->4121 4123 402d44 6 API calls 4118->4123 4126 402dc3 4118->4126 4119->4118 4119->4120 4122 406694 5 API calls 4120->4122 4121->4126 4124 402dbf 4122->4124 4123->4118 4125 402de0 RegDeleteKeyW 4124->4125 4124->4126 4125->4126 4126->4115 3363 40338f SetErrorMode GetVersion 3364 4033ce 3363->3364 3365 4033d4 3363->3365 3366 406694 5 API calls 3364->3366 3367 406624 3 API calls 3365->3367 3366->3365 3368 4033ea lstrlenA 3367->3368 3368->3365 3369 4033fa 3368->3369 3370 406694 5 API calls 3369->3370 3371 403401 3370->3371 3372 406694 5 API calls 3371->3372 3373 403408 3372->3373 3374 406694 5 API calls 3373->3374 3375 403414 #17 OleInitialize SHGetFileInfoW 3374->3375 3453 4062ba lstrcpynW 3375->3453 3378 403460 GetCommandLineW 3454 4062ba lstrcpynW 3378->3454 3380 403472 3381 405bbc CharNextW 3380->3381 3382 403497 CharNextW 3381->3382 3383 4035c1 GetTempPathW 3382->3383 3394 4034b0 3382->3394 3455 40335e 3383->3455 3385 4035d9 3386 403633 DeleteFileW 3385->3386 3387 4035dd GetWindowsDirectoryW lstrcatW 3385->3387 3465 402edd GetTickCount GetModuleFileNameW 3386->3465 3388 40335e 12 API calls 3387->3388 3391 4035f9 3388->3391 3389 405bbc CharNextW 3389->3394 3391->3386 3393 4035fd GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3391->3393 3392 403647 3395 4036fe ExitProcess CoUninitialize 3392->3395 3404 405bbc CharNextW 3392->3404 3436 4036ea 3392->3436 3396 40335e 12 API calls 3393->3396 3394->3389 3397 4035ac 3394->3397 3398 4035aa 3394->3398 3399 403834 3395->3399 3400 403714 3395->3400 3402 40362b 3396->3402 3549 4062ba lstrcpynW 3397->3549 3398->3383 3401 40383c GetCurrentProcess OpenProcessToken 3399->3401 3411 4038b8 ExitProcess 3399->3411 3406 405920 MessageBoxIndirectW 3400->3406 3408 403854 LookupPrivilegeValueW AdjustTokenPrivileges 3401->3408 3409 403888 3401->3409 3402->3386 3402->3395 3420 403666 3404->3420 3407 403722 ExitProcess 3406->3407 3408->3409 3413 406694 5 API calls 3409->3413 3410 4036fa 3410->3395 3416 40388f 3413->3416 3414 4036c4 3418 405c97 18 API calls 3414->3418 3415 40372a 3417 40588b 5 API calls 3415->3417 3419 4038a4 ExitWindowsEx 3416->3419 3423 4038b1 3416->3423 3421 40372f lstrcatW 3417->3421 3422 4036d0 3418->3422 3419->3411 3419->3423 3420->3414 3420->3415 3424 403740 lstrcatW 3421->3424 3425 40374b lstrcatW lstrcmpiW 3421->3425 3422->3395 3550 4062ba lstrcpynW 3422->3550 3557 40140b 3423->3557 3424->3425 3425->3395 3427 403767 3425->3427 3429 403773 3427->3429 3430 40376c 3427->3430 3434 40586e 2 API calls 3429->3434 3432 4057f1 4 API calls 3430->3432 3431 4036df 3551 4062ba lstrcpynW 3431->3551 3435 403771 3432->3435 3437 403778 SetCurrentDirectoryW 3434->3437 3435->3437 3493 4039aa 3436->3493 3438 403793 3437->3438 3439 403788 3437->3439 3553 4062ba lstrcpynW 3438->3553 3552 4062ba lstrcpynW 3439->3552 3442 4062dc 17 API calls 3443 4037d2 DeleteFileW 3442->3443 3444 4037df CopyFileW 3443->3444 3450 4037a1 3443->3450 3444->3450 3445 403828 3446 406080 36 API calls 3445->3446 3448 40382f 3446->3448 3447 406080 36 API calls 3447->3450 3448->3395 3449 4062dc 17 API calls 3449->3450 3450->3442 3450->3445 3450->3447 3450->3449 3452 403813 CloseHandle 3450->3452 3554 4058a3 CreateProcessW 3450->3554 3452->3450 3453->3378 3454->3380 3456 40654e 5 API calls 3455->3456 3458 40336a 3456->3458 3457 403374 3457->3385 3458->3457 3459 405b8f 3 API calls 3458->3459 3460 40337c 3459->3460 3461 40586e 2 API calls 3460->3461 3462 403382 3461->3462 3560 405ddf 3462->3560 3564 405db0 GetFileAttributesW CreateFileW 3465->3564 3467 402f1d 3492 402f2d 3467->3492 3565 4062ba lstrcpynW 3467->3565 3469 402f43 3470 405bdb 2 API calls 3469->3470 3471 402f49 3470->3471 3566 4062ba lstrcpynW 3471->3566 3473 402f54 GetFileSize 3474 403050 3473->3474 3491 402f6b 3473->3491 3567 402e79 3474->3567 3476 403059 3478 403089 GlobalAlloc 3476->3478 3476->3492 3579 403347 SetFilePointer 3476->3579 3477 403331 ReadFile 3477->3491 3578 403347 SetFilePointer 3478->3578 3480 4030bc 3482 402e79 6 API calls 3480->3482 3482->3492 3483 403072 3485 403331 ReadFile 3483->3485 3484 4030a4 3486 403116 31 API calls 3484->3486 3487 40307d 3485->3487 3489 4030b0 3486->3489 3487->3478 3487->3492 3488 402e79 6 API calls 3488->3491 3489->3489 3490 4030ed SetFilePointer 3489->3490 3489->3492 3490->3492 3491->3474 3491->3477 3491->3480 3491->3488 3491->3492 3492->3392 3494 406694 5 API calls 3493->3494 3495 4039be 3494->3495 3496 4039c4 3495->3496 3497 4039d6 3495->3497 3592 406201 wsprintfW 3496->3592 3498 406188 3 API calls 3497->3498 3499 403a06 3498->3499 3501 403a25 lstrcatW 3499->3501 3503 406188 3 API calls 3499->3503 3502 4039d4 3501->3502 3584 403c80 3502->3584 3503->3501 3506 405c97 18 API calls 3507 403a57 3506->3507 3508 403aeb 3507->3508 3510 406188 3 API calls 3507->3510 3509 405c97 18 API calls 3508->3509 3511 403af1 3509->3511 3512 403a89 3510->3512 3513 403b01 LoadImageW 3511->3513 3514 4062dc 17 API calls 3511->3514 3512->3508 3517 403aaa lstrlenW 3512->3517 3520 405bbc CharNextW 3512->3520 3515 403ba7 3513->3515 3516 403b28 RegisterClassW 3513->3516 3514->3513 3519 40140b 2 API calls 3515->3519 3518 403b5e SystemParametersInfoW CreateWindowExW 3516->3518 3548 403bb1 3516->3548 3521 403ab8 lstrcmpiW 3517->3521 3522 403ade 3517->3522 3518->3515 3523 403bad 3519->3523 3524 403aa7 3520->3524 3521->3522 3525 403ac8 GetFileAttributesW 3521->3525 3526 405b8f 3 API calls 3522->3526 3528 403c80 18 API calls 3523->3528 3523->3548 3524->3517 3527 403ad4 3525->3527 3529 403ae4 3526->3529 3527->3522 3531 405bdb 2 API calls 3527->3531 3532 403bbe 3528->3532 3593 4062ba lstrcpynW 3529->3593 3531->3522 3533 403bca ShowWindow 3532->3533 3534 403c4d 3532->3534 3535 406624 3 API calls 3533->3535 3536 4053f5 5 API calls 3534->3536 3537 403be2 3535->3537 3538 403c53 3536->3538 3539 403bf0 GetClassInfoW 3537->3539 3542 406624 3 API calls 3537->3542 3540 403c57 3538->3540 3541 403c6f 3538->3541 3544 403c04 GetClassInfoW RegisterClassW 3539->3544 3545 403c1a DialogBoxParamW 3539->3545 3546 40140b 2 API calls 3540->3546 3540->3548 3543 40140b 2 API calls 3541->3543 3542->3539 3543->3548 3544->3545 3547 40140b 2 API calls 3545->3547 3546->3548 3547->3548 3548->3410 3549->3398 3550->3431 3551->3436 3552->3438 3553->3450 3555 4058e2 3554->3555 3556 4058d6 CloseHandle 3554->3556 3555->3450 3556->3555 3558 401389 2 API calls 3557->3558 3559 401420 3558->3559 3559->3411 3561 405dec GetTickCount GetTempFileNameW 3560->3561 3562 405e22 3561->3562 3563 40338d 3561->3563 3562->3561 3562->3563 3563->3385 3564->3467 3565->3469 3566->3473 3568 402e82 3567->3568 3569 402e9a 3567->3569 3570 402e92 3568->3570 3571 402e8b DestroyWindow 3568->3571 3572 402ea2 3569->3572 3573 402eaa GetTickCount 3569->3573 3570->3476 3571->3570 3580 4066d0 3572->3580 3575 402eb8 CreateDialogParamW ShowWindow 3573->3575 3576 402edb 3573->3576 3575->3576 3576->3476 3578->3484 3579->3483 3581 4066ed PeekMessageW 3580->3581 3582 4066e3 DispatchMessageW 3581->3582 3583 402ea8 3581->3583 3582->3581 3583->3476 3585 403c94 3584->3585 3594 406201 wsprintfW 3585->3594 3587 403d05 3595 403d39 3587->3595 3589 403d0a 3590 403a35 3589->3590 3591 4062dc 17 API calls 3589->3591 3590->3506 3591->3589 3592->3502 3593->3508 3594->3587 3596 4062dc 17 API calls 3595->3596 3597 403d47 SetWindowTextW 3596->3597 3597->3589 4127 40190f 4128 402c41 17 API calls 4127->4128 4129 401916 4128->4129 4130 405920 MessageBoxIndirectW 4129->4130 4131 40191f 4130->4131 4132 401491 4133 405322 24 API calls 4132->4133 4134 401498 4133->4134 4135 401d14 4136 402c1f 17 API calls 4135->4136 4137 401d1b 4136->4137 4138 402c1f 17 API calls 4137->4138 4139 401d27 GetDlgItem 4138->4139 4140 402592 4139->4140 4141 405296 4142 4052a6 4141->4142 4143 4052ba 4141->4143 4145 4052ac 4142->4145 4153 405303 4142->4153 4144 4052c2 IsWindowVisible 4143->4144 4147 4052d9 4143->4147 4146 4052cf 4144->4146 4144->4153 4149 40427d SendMessageW 4145->4149 4154 404bec SendMessageW 4146->4154 4148 405308 CallWindowProcW 4147->4148 4159 404c6c 4147->4159 4150 4052b6 4148->4150 4149->4150 4153->4148 4155 404c4b SendMessageW 4154->4155 4156 404c0f GetMessagePos ScreenToClient SendMessageW 4154->4156 4157 404c43 4155->4157 4156->4157 4158 404c48 4156->4158 4157->4147 4158->4155 4168 4062ba lstrcpynW 4159->4168 4161 404c7f 4169 406201 wsprintfW 4161->4169 4163 404c89 4164 40140b 2 API calls 4163->4164 4165 404c92 4164->4165 4170 4062ba lstrcpynW 4165->4170 4167 404c99 4167->4153 4168->4161 4169->4163 4170->4167 4171 402598 4172 4025c7 4171->4172 4173 4025ac 4171->4173 4175 4025fb 4172->4175 4176 4025cc 4172->4176 4174 402c1f 17 API calls 4173->4174 4181 4025b3 4174->4181 4178 402c41 17 API calls 4175->4178 4177 402c41 17 API calls 4176->4177 4179 4025d3 WideCharToMultiByte lstrlenA 4177->4179 4180 402602 lstrlenW 4178->4180 4179->4181 4180->4181 4182 40262f 4181->4182 4183 402645 4181->4183 4185 405e91 5 API calls 4181->4185 4182->4183 4184 405e62 WriteFile 4182->4184 4184->4183 4185->4182 4186 404c9e GetDlgItem GetDlgItem 4187 404cf0 7 API calls 4186->4187 4194 404f09 4186->4194 4188 404d93 DeleteObject 4187->4188 4189 404d86 SendMessageW 4187->4189 4190 404d9c 4188->4190 4189->4188 4192 404dd3 4190->4192 4193 4062dc 17 API calls 4190->4193 4191 404fed 4196 405099 4191->4196 4207 405046 SendMessageW 4191->4207 4229 404efc 4191->4229 4195 404231 18 API calls 4192->4195 4198 404db5 SendMessageW SendMessageW 4193->4198 4194->4191 4197 404f7a 4194->4197 4205 404bec 5 API calls 4194->4205 4201 404de7 4195->4201 4199 4050a3 SendMessageW 4196->4199 4200 4050ab 4196->4200 4197->4191 4203 404fdf SendMessageW 4197->4203 4198->4190 4199->4200 4204 4050d4 4200->4204 4209 4050c4 4200->4209 4210 4050bd ImageList_Destroy 4200->4210 4206 404231 18 API calls 4201->4206 4202 404298 8 API calls 4208 40528f 4202->4208 4203->4191 4212 405243 4204->4212 4228 404c6c 4 API calls 4204->4228 4233 40510f 4204->4233 4205->4197 4211 404df5 4206->4211 4213 40505b SendMessageW 4207->4213 4207->4229 4209->4204 4214 4050cd GlobalFree 4209->4214 4210->4209 4215 404eca GetWindowLongW SetWindowLongW 4211->4215 4222 404ec4 4211->4222 4225 404e45 SendMessageW 4211->4225 4226 404e81 SendMessageW 4211->4226 4227 404e92 SendMessageW 4211->4227 4216 405255 ShowWindow GetDlgItem ShowWindow 4212->4216 4212->4229 4218 40506e 4213->4218 4214->4204 4217 404ee3 4215->4217 4216->4229 4219 404f01 4217->4219 4220 404ee9 ShowWindow 4217->4220 4221 40507f SendMessageW 4218->4221 4238 404266 SendMessageW 4219->4238 4237 404266 SendMessageW 4220->4237 4221->4196 4222->4215 4222->4217 4225->4211 4226->4211 4227->4211 4228->4233 4229->4202 4230 405219 InvalidateRect 4230->4212 4231 40522f 4230->4231 4239 404ba7 4231->4239 4232 40513d SendMessageW 4236 405153 4232->4236 4233->4232 4233->4236 4235 4051c7 SendMessageW SendMessageW 4235->4236 4236->4230 4236->4235 4237->4229 4238->4194 4242 404ade 4239->4242 4241 404bbc 4241->4212 4243 404af7 4242->4243 4244 4062dc 17 API calls 4243->4244 4245 404b5b 4244->4245 4246 4062dc 17 API calls 4245->4246 4247 404b66 4246->4247 4248 4062dc 17 API calls 4247->4248 4249 404b7c lstrlenW wsprintfW SetDlgItemTextW 4248->4249 4249->4241 4250 40149e 4251 4022f7 4250->4251 4252 4014ac PostQuitMessage 4250->4252 4252->4251 3750 401c1f 3751 402c1f 17 API calls 3750->3751 3752 401c26 3751->3752 3753 402c1f 17 API calls 3752->3753 3754 401c33 3753->3754 3755 401c48 3754->3755 3757 402c41 17 API calls 3754->3757 3756 401c58 3755->3756 3758 402c41 17 API calls 3755->3758 3759 401c63 3756->3759 3760 401caf 3756->3760 3757->3755 3758->3756 3761 402c1f 17 API calls 3759->3761 3762 402c41 17 API calls 3760->3762 3763 401c68 3761->3763 3764 401cb4 3762->3764 3765 402c1f 17 API calls 3763->3765 3766 402c41 17 API calls 3764->3766 3767 401c74 3765->3767 3768 401cbd FindWindowExW 3766->3768 3769 401c81 SendMessageTimeoutW 3767->3769 3770 401c9f SendMessageW 3767->3770 3771 401cdf 3768->3771 3769->3771 3770->3771 4253 402aa0 SendMessageW 4254 402ac5 4253->4254 4255 402aba InvalidateRect 4253->4255 4255->4254 4256 402821 4257 402827 4256->4257 4258 402ac5 4257->4258 4259 40282f FindClose 4257->4259 4259->4258 4260 4043a1 lstrlenW 4261 4043c0 4260->4261 4262 4043c2 WideCharToMultiByte 4260->4262 4261->4262 4263 404722 4264 40474e 4263->4264 4265 40475f 4263->4265 4324 405904 GetDlgItemTextW 4264->4324 4267 40476b GetDlgItem 4265->4267 4273 4047ca 4265->4273 4269 40477f 4267->4269 4268 404759 4271 40654e 5 API calls 4268->4271 4272 404793 SetWindowTextW 4269->4272 4280 405c3a 4 API calls 4269->4280 4270 4048ae 4274 404a5d 4270->4274 4326 405904 GetDlgItemTextW 4270->4326 4271->4265 4276 404231 18 API calls 4272->4276 4273->4270 4273->4274 4277 4062dc 17 API calls 4273->4277 4279 404298 8 API calls 4274->4279 4281 4047af 4276->4281 4282 40483e SHBrowseForFolderW 4277->4282 4278 4048de 4283 405c97 18 API calls 4278->4283 4284 404a71 4279->4284 4285 404789 4280->4285 4286 404231 18 API calls 4281->4286 4282->4270 4287 404856 CoTaskMemFree 4282->4287 4288 4048e4 4283->4288 4285->4272 4291 405b8f 3 API calls 4285->4291 4289 4047bd 4286->4289 4290 405b8f 3 API calls 4287->4290 4327 4062ba lstrcpynW 4288->4327 4325 404266 SendMessageW 4289->4325 4293 404863 4290->4293 4291->4272 4296 40489a SetDlgItemTextW 4293->4296 4300 4062dc 17 API calls 4293->4300 4295 4047c3 4298 406694 5 API calls 4295->4298 4296->4270 4297 4048fb 4299 406694 5 API calls 4297->4299 4298->4273 4307 404902 4299->4307 4301 404882 lstrcmpiW 4300->4301 4301->4296 4304 404893 lstrcatW 4301->4304 4302 404943 4328 4062ba lstrcpynW 4302->4328 4304->4296 4305 40494a 4306 405c3a 4 API calls 4305->4306 4308 404950 GetDiskFreeSpaceW 4306->4308 4307->4302 4310 405bdb 2 API calls 4307->4310 4312 40499b 4307->4312 4311 404974 MulDiv 4308->4311 4308->4312 4310->4307 4311->4312 4313 404a0c 4312->4313 4314 404ba7 20 API calls 4312->4314 4315 404a2f 4313->4315 4317 40140b 2 API calls 4313->4317 4316 4049f9 4314->4316 4329 404253 KiUserCallbackDispatcher 4315->4329 4319 404a0e SetDlgItemTextW 4316->4319 4320 4049fe 4316->4320 4317->4315 4319->4313 4322 404ade 20 API calls 4320->4322 4321 404a4b 4321->4274 4323 40467b SendMessageW 4321->4323 4322->4313 4323->4274 4324->4268 4325->4295 4326->4278 4327->4297 4328->4305 4329->4321 4330 4015a3 4331 402c41 17 API calls 4330->4331 4332 4015aa SetFileAttributesW 4331->4332 4333 4015bc 4332->4333 4334 4029a8 4335 402c1f 17 API calls 4334->4335 4336 4029ae 4335->4336 4337 4029d5 4336->4337 4338 4029ee 4336->4338 4346 40288b 4336->4346 4341 4029da 4337->4341 4347 4029eb 4337->4347 4339 402a08 4338->4339 4340 4029f8 4338->4340 4343 4062dc 17 API calls 4339->4343 4342 402c1f 17 API calls 4340->4342 4348 4062ba lstrcpynW 4341->4348 4342->4347 4343->4347 4347->4346 4349 406201 wsprintfW 4347->4349 4348->4346 4349->4346 4350 4028ad 4351 402c41 17 API calls 4350->4351 4353 4028bb 4351->4353 4352 4028d1 4355 405d8b 2 API calls 4352->4355 4353->4352 4354 402c41 17 API calls 4353->4354 4354->4352 4356 4028d7 4355->4356 4378 405db0 GetFileAttributesW CreateFileW 4356->4378 4358 4028e4 4359 4028f0 GlobalAlloc 4358->4359 4360 402987 4358->4360 4363 402909 4359->4363 4364 40297e CloseHandle 4359->4364 4361 4029a2 4360->4361 4362 40298f DeleteFileW 4360->4362 4362->4361 4379 403347 SetFilePointer 4363->4379 4364->4360 4366 40290f 4367 403331 ReadFile 4366->4367 4368 402918 GlobalAlloc 4367->4368 4369 402928 4368->4369 4370 40295c 4368->4370 4371 403116 31 API calls 4369->4371 4372 405e62 WriteFile 4370->4372 4374 402935 4371->4374 4373 402968 GlobalFree 4372->4373 4375 403116 31 API calls 4373->4375 4376 402953 GlobalFree 4374->4376 4377 40297b 4375->4377 4376->4370 4377->4364 4378->4358 4379->4366 4380 401a30 4381 402c41 17 API calls 4380->4381 4382 401a39 ExpandEnvironmentStringsW 4381->4382 4383 401a4d 4382->4383 4385 401a60 4382->4385 4384 401a52 lstrcmpW 4383->4384 4383->4385 4384->4385 3609 402032 3610 402044 3609->3610 3620 4020f6 3609->3620 3611 402c41 17 API calls 3610->3611 3613 40204b 3611->3613 3612 401423 24 API calls 3614 402250 3612->3614 3615 402c41 17 API calls 3613->3615 3616 402054 3615->3616 3617 40206a LoadLibraryExW 3616->3617 3618 40205c GetModuleHandleW 3616->3618 3619 40207b 3617->3619 3617->3620 3618->3617 3618->3619 3629 406703 WideCharToMultiByte 3619->3629 3620->3612 3623 4020c5 3625 405322 24 API calls 3623->3625 3624 40208c 3626 401423 24 API calls 3624->3626 3627 40209c 3624->3627 3625->3627 3626->3627 3627->3614 3628 4020e8 FreeLibrary 3627->3628 3628->3614 3630 40672d GetProcAddress 3629->3630 3631 402086 3629->3631 3630->3631 3631->3623 3631->3624 4391 401735 4392 402c41 17 API calls 4391->4392 4393 40173c SearchPathW 4392->4393 4394 401757 4393->4394 4395 402a35 4396 402c1f 17 API calls 4395->4396 4397 402a3b 4396->4397 4398 402a72 4397->4398 4399 40288b 4397->4399 4401 402a4d 4397->4401 4398->4399 4400 4062dc 17 API calls 4398->4400 4400->4399 4401->4399 4403 406201 wsprintfW 4401->4403 4403->4399 4404 4014b8 4405 4014be 4404->4405 4406 401389 2 API calls 4405->4406 4407 4014c6 4406->4407 4408 401db9 GetDC 4409 402c1f 17 API calls 4408->4409 4410 401dcb GetDeviceCaps MulDiv ReleaseDC 4409->4410 4411 402c1f 17 API calls 4410->4411 4412 401dfc 4411->4412 4413 4062dc 17 API calls 4412->4413 4414 401e39 CreateFontIndirectW 4413->4414 4415 402592 4414->4415 4416 40283b 4417 402843 4416->4417 4418 402847 FindNextFileW 4417->4418 4421 402859 4417->4421 4419 4028a0 4418->4419 4418->4421 4422 4062ba lstrcpynW 4419->4422 4422->4421

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410stringfilecomCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 40338f-4033cc SetErrorMode GetVersion 1 4033ce-4033d6 call 406694 0->1 2 4033df 0->2 1->2 7 4033d8 1->7 4 4033e4-4033f8 call 406624 lstrlenA 2->4 9 4033fa-403416 call 406694 * 3 4->9 7->2 16 403427-403486 #17 OleInitialize SHGetFileInfoW call 4062ba GetCommandLineW call 4062ba 9->16 17 403418-40341e 9->17 24 403490-4034aa call 405bbc CharNextW 16->24 25 403488-40348f 16->25 17->16 21 403420 17->21 21->16 28 4034b0-4034b6 24->28 29 4035c1-4035db GetTempPathW call 40335e 24->29 25->24 30 4034b8-4034bd 28->30 31 4034bf-4034c3 28->31 38 403633-40364d DeleteFileW call 402edd 29->38 39 4035dd-4035fb GetWindowsDirectoryW lstrcatW call 40335e 29->39 30->30 30->31 33 4034c5-4034c9 31->33 34 4034ca-4034ce 31->34 33->34 36 4034d4-4034da 34->36 37 40358d-40359a call 405bbc 34->37 43 4034f5-40352e 36->43 44 4034dc-4034e4 36->44 54 40359c-40359d 37->54 55 40359e-4035a4 37->55 56 403653-403659 38->56 57 4036fe-40370e ExitProcess CoUninitialize 38->57 39->38 52 4035fd-40362d GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40335e 39->52 50 403530-403535 43->50 51 40354b-403585 43->51 48 4034e6-4034e9 44->48 49 4034eb 44->49 48->43 48->49 49->43 50->51 58 403537-40353f 50->58 51->37 53 403587-40358b 51->53 52->38 52->57 53->37 60 4035ac-4035ba call 4062ba 53->60 54->55 55->28 61 4035aa 55->61 62 4036ee-4036f5 call 4039aa 56->62 63 40365f-40366a call 405bbc 56->63 64 403834-40383a 57->64 65 403714-403724 call 405920 ExitProcess 57->65 66 403541-403544 58->66 67 403546 58->67 71 4035bf 60->71 61->71 80 4036fa 62->80 84 4036b8-4036c2 63->84 85 40366c-4036a1 63->85 68 4038b8-4038c0 64->68 69 40383c-403852 GetCurrentProcess OpenProcessToken 64->69 66->51 66->67 67->51 81 4038c2 68->81 82 4038c6-4038ca ExitProcess 68->82 77 403854-403882 LookupPrivilegeValueW AdjustTokenPrivileges 69->77 78 403888-403896 call 406694 69->78 71->29 77->78 92 4038a4-4038af ExitWindowsEx 78->92 93 403898-4038a2 78->93 80->57 81->82 86 4036c4-4036d2 call 405c97 84->86 87 40372a-40373e call 40588b lstrcatW 84->87 89 4036a3-4036a7 85->89 86->57 102 4036d4-4036ea call 4062ba * 2 86->102 100 403740-403746 lstrcatW 87->100 101 40374b-403765 lstrcatW lstrcmpiW 87->101 94 4036b0-4036b4 89->94 95 4036a9-4036ae 89->95 92->68 99 4038b1-4038b3 call 40140b 92->99 93->92 93->99 94->89 96 4036b6 94->96 95->94 95->96 96->84 99->68 100->101 101->57 105 403767-40376a 101->105 102->62 107 403773 call 40586e 105->107 108 40376c-403771 call 4057f1 105->108 115 403778-403786 SetCurrentDirectoryW 107->115 108->115 116 403793-4037bc call 4062ba 115->116 117 403788-40378e call 4062ba 115->117 121 4037c1-4037dd call 4062dc DeleteFileW 116->121 117->116 124 40381e-403826 121->124 125 4037df-4037ef CopyFileW 121->125 124->121 127 403828-40382f call 406080 124->127 125->124 126 4037f1-403811 call 406080 call 4062dc call 4058a3 125->126 126->124 136 403813-40381a CloseHandle 126->136 127->57 136->124
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetErrorMode.KERNELBASE ref: 004033B2
                                                                                                                                                                                                                            • GetVersion.KERNEL32 ref: 004033B8
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
                                                                                                                                                                                                                            • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040342F
                                                                                                                                                                                                                            • SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
                                                                                                                                                                                                                            • CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498
                                                                                                                                                                                                                              • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                              • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
                                                                                                                                                                                                                            • DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638
                                                                                                                                                                                                                              • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                            • ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
                                                                                                                                                                                                                            • CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403724
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
                                                                                                                                                                                                                            • CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
                                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
                                                                                                                                                                                                                            • AdjustTokenPrivileges.ADVAPI32 ref: 00403882
                                                                                                                                                                                                                            • ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 004038CA
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                                                                            • String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                            • API String ID: 424501083-3195845224
                                                                                                                                                                                                                            • Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                                                            • Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E
                                                                                                                                                                                                                            Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 137 405461-40547c 138 405482-405549 GetDlgItem * 3 call 404266 call 404bbf GetClientRect GetSystemMetrics SendMessageW * 2 137->138 139 40560b-405612 137->139 160 405567-40556a 138->160 161 40554b-405565 SendMessageW * 2 138->161 141 405614-405636 GetDlgItem CreateThread CloseHandle 139->141 142 40563c-405649 139->142 141->142 144 405667-405671 142->144 145 40564b-405651 142->145 149 405673-405679 144->149 150 4056c7-4056cb 144->150 147 405653-405662 ShowWindow * 2 call 404266 145->147 148 40568c-405695 call 404298 145->148 147->144 157 40569a-40569e 148->157 155 4056a1-4056b1 ShowWindow 149->155 156 40567b-405687 call 40420a 149->156 150->148 153 4056cd-4056d3 150->153 153->148 162 4056d5-4056e8 SendMessageW 153->162 158 4056c1-4056c2 call 40420a 155->158 159 4056b3-4056bc call 405322 155->159 156->148 158->150 159->158 166 40557a-405591 call 404231 160->166 167 40556c-405578 SendMessageW 160->167 161->160 168 4057ea-4057ec 162->168 169 4056ee-405719 CreatePopupMenu call 4062dc AppendMenuW 162->169 176 405593-4055a7 ShowWindow 166->176 177 4055c7-4055e8 GetDlgItem SendMessageW 166->177 167->166 168->157 174 40571b-40572b GetWindowRect 169->174 175 40572e-405743 TrackPopupMenu 169->175 174->175 175->168 179 405749-405760 175->179 180 4055b6 176->180 181 4055a9-4055b4 ShowWindow 176->181 177->168 178 4055ee-405606 SendMessageW * 2 177->178 178->168 182 405765-405780 SendMessageW 179->182 183 4055bc-4055c2 call 404266 180->183 181->183 182->182 184 405782-4057a5 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 182->184 183->177 186 4057a7-4057ce SendMessageW 184->186 186->186 187 4057d0-4057e4 GlobalUnlock SetClipboardData CloseClipboard 186->187 187->168
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 004054BF
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004054CE
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040550B
                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000002), ref: 00405512
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 004055AE
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004055CF
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 004054DD
                                                                                                                                                                                                                              • Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405621
                                                                                                                                                                                                                            • CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
                                                                                                                                                                                                                            • CloseHandle.KERNELBASE(00000000), ref: 00405636
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 0040565A
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 0040565F
                                                                                                                                                                                                                            • ShowWindow.USER32(00000008), ref: 004056A9
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
                                                                                                                                                                                                                            • CreatePopupMenu.USER32 ref: 004056EE
                                                                                                                                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 00405722
                                                                                                                                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
                                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 00405783
                                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 00405789
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 0040579F
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 004057D3
                                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
                                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 004057E4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                            • String ID: {
                                                                                                                                                                                                                            • API String ID: 590372296-366298937
                                                                                                                                                                                                                            • Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                                                            • Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58
                                                                                                                                                                                                                            Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 497 4059cc-4059f2 call 405c97 500 4059f4-405a06 DeleteFileW 497->500 501 405a0b-405a12 497->501 502 405b88-405b8c 500->502 503 405a14-405a16 501->503 504 405a25-405a35 call 4062ba 501->504 505 405b36-405b3b 503->505 506 405a1c-405a1f 503->506 510 405a44-405a45 call 405bdb 504->510 511 405a37-405a42 lstrcatW 504->511 505->502 509 405b3d-405b40 505->509 506->504 506->505 512 405b42-405b48 509->512 513 405b4a-405b52 call 4065fd 509->513 514 405a4a-405a4e 510->514 511->514 512->502 513->502 521 405b54-405b68 call 405b8f call 405984 513->521 517 405a50-405a58 514->517 518 405a5a-405a60 lstrcatW 514->518 517->518 520 405a65-405a81 lstrlenW FindFirstFileW 517->520 518->520 522 405a87-405a8f 520->522 523 405b2b-405b2f 520->523 537 405b80-405b83 call 405322 521->537 538 405b6a-405b6d 521->538 527 405a91-405a99 522->527 528 405aaf-405ac3 call 4062ba 522->528 523->505 526 405b31 523->526 526->505 531 405a9b-405aa3 527->531 532 405b0e-405b1e FindNextFileW 527->532 539 405ac5-405acd 528->539 540 405ada-405ae5 call 405984 528->540 531->528 533 405aa5-405aad 531->533 532->522 536 405b24-405b25 FindClose 532->536 533->528 533->532 536->523 537->502 538->512 541 405b6f-405b7e call 405322 call 406080 538->541 539->532 542 405acf-405ad3 call 4059cc 539->542 550 405b06-405b09 call 405322 540->550 551 405ae7-405aea 540->551 541->502 549 405ad8 542->549 549->532 550->532 554 405aec-405afc call 405322 call 406080 551->554 555 405afe-405b04 551->555 554->532 555->532
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DeleteFileW.KERNELBASE(?,?,004DF000,74DF3420,00000000), ref: 004059F5
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00460250,\*.*,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A3D
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A60
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A66
                                                                                                                                                                                                                            • FindFirstFileW.KERNELBASE(00460250,?,?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A76
                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 00405B25
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                            • String ID: \*.*
                                                                                                                                                                                                                            • API String ID: 2035342205-1173974218
                                                                                                                                                                                                                            • Opcode ID: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
                                                                                                                                                                                                                            • Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E
                                                                                                                                                                                                                            Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
                                                                                                                                                                                                                            • FindClose.KERNELBASE(00000000), ref: 00406614
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                            • Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                                                            • Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D
                                                                                                                                                                                                                            Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 542301482-0
                                                                                                                                                                                                                            • Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                                                            • Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44
                                                                                                                                                                                                                            Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 188 403d58-403d6a 189 403d70-403d76 188->189 190 403eab-403eba 188->190 189->190 191 403d7c-403d85 189->191 192 403f09-403f1e 190->192 193 403ebc-403ef7 GetDlgItem * 2 call 404231 KiUserCallbackDispatcher call 40140b 190->193 196 403d87-403d94 SetWindowPos 191->196 197 403d9a-403d9d 191->197 194 403f20-403f23 192->194 195 403f5e-403f63 call 40427d 192->195 216 403efc-403f04 193->216 199 403f25-403f30 call 401389 194->199 200 403f56-403f58 194->200 207 403f68-403f83 195->207 196->197 202 403db7-403dbd 197->202 203 403d9f-403db1 ShowWindow 197->203 199->200 221 403f32-403f51 SendMessageW 199->221 200->195 206 4041fe 200->206 208 403dd9-403ddc 202->208 209 403dbf-403dd4 DestroyWindow 202->209 203->202 214 404200-404207 206->214 212 403f85-403f87 call 40140b 207->212 213 403f8c-403f92 207->213 217 403dde-403dea SetWindowLongW 208->217 218 403def-403df5 208->218 215 4041db-4041e1 209->215 212->213 224 403f98-403fa3 213->224 225 4041bc-4041d5 DestroyWindow EndDialog 213->225 215->206 223 4041e3-4041e9 215->223 216->192 217->214 219 403e98-403ea6 call 404298 218->219 220 403dfb-403e0c GetDlgItem 218->220 219->214 226 403e2b-403e2e 220->226 227 403e0e-403e25 SendMessageW IsWindowEnabled 220->227 221->214 223->206 229 4041eb-4041f4 ShowWindow 223->229 224->225 230 403fa9-403ff6 call 4062dc call 404231 * 3 GetDlgItem 224->230 225->215 231 403e30-403e31 226->231 232 403e33-403e36 226->232 227->206 227->226 229->206 258 404000-40403c ShowWindow KiUserCallbackDispatcher call 404253 EnableWindow 230->258 259 403ff8-403ffd 230->259 235 403e61-403e66 call 40420a 231->235 236 403e44-403e49 232->236 237 403e38-403e3e 232->237 235->219 241 403e7f-403e92 SendMessageW 236->241 242 403e4b-403e51 236->242 240 403e40-403e42 237->240 237->241 240->235 241->219 246 403e53-403e59 call 40140b 242->246 247 403e68-403e71 call 40140b 242->247 256 403e5f 246->256 247->219 255 403e73-403e7d 247->255 255->256 256->235 262 404041 258->262 263 40403e-40403f 258->263 259->258 264 404043-404071 GetSystemMenu EnableMenuItem SendMessageW 262->264 263->264 265 404073-404084 SendMessageW 264->265 266 404086 264->266 267 40408c-4040cb call 404266 call 403d39 call 4062ba lstrlenW call 4062dc SetWindowTextW call 401389 265->267 266->267 267->207 278 4040d1-4040d3 267->278 278->207 279 4040d9-4040dd 278->279 280 4040fc-404110 DestroyWindow 279->280 281 4040df-4040e5 279->281 280->215 282 404116-404143 CreateDialogParamW 280->282 281->206 283 4040eb-4040f1 281->283 282->215 284 404149-4041a0 call 404231 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 282->284 283->207 285 4040f7 283->285 284->206 290 4041a2-4041b5 ShowWindow call 40427d 284->290 285->206 292 4041ba 290->292 292->215
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
                                                                                                                                                                                                                            • ShowWindow.USER32(?), ref: 00403DB1
                                                                                                                                                                                                                            • DestroyWindow.USER32 ref: 00403DC5
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00403E02
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
                                                                                                                                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 00403E1D
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00403ECB
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00403ED5
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00403EEF
                                                                                                                                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 00403FE6
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?), ref: 00404007
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
                                                                                                                                                                                                                            • EnableWindow.USER32(?,?), ref: 00404034
                                                                                                                                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
                                                                                                                                                                                                                            • EnableMenuItem.USER32(00000000), ref: 00404051
                                                                                                                                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,00450248), ref: 004040BA
                                                                                                                                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 004041EE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3906175533-0
                                                                                                                                                                                                                            • Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                                                            • Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E
                                                                                                                                                                                                                            Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 293 4039aa-4039c2 call 406694 296 4039c4-4039d4 call 406201 293->296 297 4039d6-403a0d call 406188 293->297 306 403a30-403a59 call 403c80 call 405c97 296->306 302 403a25-403a2b lstrcatW 297->302 303 403a0f-403a20 call 406188 297->303 302->306 303->302 311 403aeb-403af3 call 405c97 306->311 312 403a5f-403a64 306->312 318 403b01-403b26 LoadImageW 311->318 319 403af5-403afc call 4062dc 311->319 312->311 313 403a6a-403a92 call 406188 312->313 313->311 320 403a94-403a98 313->320 322 403ba7-403baf call 40140b 318->322 323 403b28-403b58 RegisterClassW 318->323 319->318 324 403aaa-403ab6 lstrlenW 320->324 325 403a9a-403aa7 call 405bbc 320->325 336 403bb1-403bb4 322->336 337 403bb9-403bc4 call 403c80 322->337 326 403c76 323->326 327 403b5e-403ba2 SystemParametersInfoW CreateWindowExW 323->327 331 403ab8-403ac6 lstrcmpiW 324->331 332 403ade-403ae6 call 405b8f call 4062ba 324->332 325->324 330 403c78-403c7f 326->330 327->322 331->332 335 403ac8-403ad2 GetFileAttributesW 331->335 332->311 339 403ad4-403ad6 335->339 340 403ad8-403ad9 call 405bdb 335->340 336->330 346 403bca-403be4 ShowWindow call 406624 337->346 347 403c4d-403c4e call 4053f5 337->347 339->332 339->340 340->332 352 403bf0-403c02 GetClassInfoW 346->352 353 403be6-403beb call 406624 346->353 351 403c53-403c55 347->351 354 403c57-403c5d 351->354 355 403c6f-403c71 call 40140b 351->355 359 403c04-403c14 GetClassInfoW RegisterClassW 352->359 360 403c1a-403c3d DialogBoxParamW call 40140b 352->360 353->352 354->336 356 403c63-403c6a call 40140b 354->356 355->326 356->336 359->360 364 403c42-403c4b call 4038fa 360->364 364->330
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                              • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,74DF3420,004CB000,00000000), ref: 00403A2B
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
                                                                                                                                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12
                                                                                                                                                                                                                              • Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E
                                                                                                                                                                                                                            • RegisterClassW.USER32(00472E80), ref: 00403B4F
                                                                                                                                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
                                                                                                                                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
                                                                                                                                                                                                                            • ShowWindow.USER32(00000005,00000000), ref: 00403BD2
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
                                                                                                                                                                                                                            • RegisterClassW.USER32(00472E80), ref: 00403C14
                                                                                                                                                                                                                            • DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                            • API String ID: 1975747703-564491471
                                                                                                                                                                                                                            • Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                                                            • Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E
                                                                                                                                                                                                                            Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 367 4062dc-4062e7 368 4062e9-4062f8 367->368 369 4062fa-406310 367->369 368->369 370 406316-406323 369->370 371 406528-40652e 369->371 370->371 374 406329-406330 370->374 372 406534-40653f 371->372 373 406335-406342 371->373 376 406541-406545 call 4062ba 372->376 377 40654a-40654b 372->377 373->372 375 406348-406354 373->375 374->371 378 406515 375->378 379 40635a-406398 375->379 376->377 383 406523-406526 378->383 384 406517-406521 378->384 381 4064b8-4064bc 379->381 382 40639e-4063a9 379->382 387 4064be-4064c4 381->387 388 4064ef-4064f3 381->388 385 4063c2 382->385 386 4063ab-4063b0 382->386 383->371 384->371 392 4063c9-4063d0 385->392 386->385 389 4063b2-4063b5 386->389 390 4064d4-4064e0 call 4062ba 387->390 391 4064c6-4064d2 call 406201 387->391 393 406502-406513 lstrlenW 388->393 394 4064f5-4064fd call 4062dc 388->394 389->385 396 4063b7-4063ba 389->396 405 4064e5-4064eb 390->405 391->405 398 4063d2-4063d4 392->398 399 4063d5-4063d7 392->399 393->371 394->393 396->385 401 4063bc-4063c0 396->401 398->399 403 406412-406415 399->403 404 4063d9-406400 call 406188 399->404 401->392 406 406425-406428 403->406 407 406417-406423 GetSystemDirectoryW 403->407 417 4064a0-4064a3 404->417 418 406406-40640d call 4062dc 404->418 405->393 409 4064ed 405->409 411 406493-406495 406->411 412 40642a-406438 GetWindowsDirectoryW 406->412 410 406497-40649b 407->410 414 4064b0-4064b6 call 40654e 409->414 410->414 419 40649d 410->419 411->410 416 40643a-406444 411->416 412->411 414->393 422 406446-406449 416->422 423 40645e-406474 SHGetSpecialFolderLocation 416->423 417->414 420 4064a5-4064ab lstrcatW 417->420 418->410 419->417 420->414 422->423 426 40644b-406452 422->426 427 406476-40648d SHGetPathFromIDListW CoTaskMemFree 423->427 428 40648f 423->428 429 40645a-40645c 426->429 427->410 427->428 428->411 429->410 429->423
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000), ref: 00406430
                                                                                                                                                                                                                            • SHGetSpecialFolderLocation.SHELL32(00405359,0042CE00,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000), ref: 0040646C
                                                                                                                                                                                                                            • SHGetPathFromIDListW.SHELL32(0042CE00,Remove folder: ), ref: 0040647A
                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(0042CE00), ref: 00406485
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000), ref: 00406503
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                                                                                                                                                            • String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                            • API String ID: 717251189-2306433671
                                                                                                                                                                                                                            • Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                                                            • Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E
                                                                                                                                                                                                                            Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 430 402edd-402f2b GetTickCount GetModuleFileNameW call 405db0 433 402f37-402f65 call 4062ba call 405bdb call 4062ba GetFileSize 430->433 434 402f2d-402f32 430->434 442 403052-403060 call 402e79 433->442 443 402f6b 433->443 435 40310f-403113 434->435 449 403062-403065 442->449 450 4030b5-4030ba 442->450 445 402f70-402f87 443->445 447 402f89 445->447 448 402f8b-402f94 call 403331 445->448 447->448 456 402f9a-402fa1 448->456 457 4030bc-4030c4 call 402e79 448->457 452 403067-40307f call 403347 call 403331 449->452 453 403089-4030b3 GlobalAlloc call 403347 call 403116 449->453 450->435 452->450 478 403081-403087 452->478 453->450 476 4030c6-4030d7 453->476 461 402fa3-402fb7 call 405d6b 456->461 462 40301d-403021 456->462 457->450 467 40302b-403031 461->467 481 402fb9-402fc0 461->481 466 403023-40302a call 402e79 462->466 462->467 466->467 473 403040-40304a 467->473 474 403033-40303d call 406787 467->474 473->445 477 403050 473->477 474->473 483 4030d9 476->483 484 4030df-4030e4 476->484 477->442 478->450 478->453 481->467 482 402fc2-402fc9 481->482 482->467 486 402fcb-402fd2 482->486 483->484 487 4030e5-4030eb 484->487 486->467 488 402fd4-402fdb 486->488 487->487 489 4030ed-403108 SetFilePointer call 405d6b 487->489 488->467 490 402fdd-402ffd 488->490 493 40310d 489->493 490->450 492 403003-403007 490->492 494 403009-40300d 492->494 495 40300f-403017 492->495 493->435 494->477 494->495 495->467 496 403019-40301b 495->496 496->467
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402EEE
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A
                                                                                                                                                                                                                              • Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                              • Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Error launching installer, xrefs: 00402F2D
                                                                                                                                                                                                                            • Inst, xrefs: 00402FC2
                                                                                                                                                                                                                            • soft, xrefs: 00402FCB
                                                                                                                                                                                                                            • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
                                                                                                                                                                                                                            • Null, xrefs: 00402FD4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                                                                                                                                                            • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                            • API String ID: 4283519449-527102705
                                                                                                                                                                                                                            • Opcode ID: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
                                                                                                                                                                                                                            • Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D
                                                                                                                                                                                                                            Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 561 40176f-401794 call 402c41 call 405c06 566 401796-40179c call 4062ba 561->566 567 40179e-4017b0 call 4062ba call 405b8f lstrcatW 561->567 572 4017b5-4017b6 call 40654e 566->572 567->572 576 4017bb-4017bf 572->576 577 4017c1-4017cb call 4065fd 576->577 578 4017f2-4017f5 576->578 586 4017dd-4017ef 577->586 587 4017cd-4017db CompareFileTime 577->587 580 4017f7-4017f8 call 405d8b 578->580 581 4017fd-401819 call 405db0 578->581 580->581 588 40181b-40181e 581->588 589 40188d-4018b6 call 405322 call 403116 581->589 586->578 587->586 590 401820-40185e call 4062ba * 2 call 4062dc call 4062ba call 405920 588->590 591 40186f-401879 call 405322 588->591 603 4018b8-4018bc 589->603 604 4018be-4018ca SetFileTime 589->604 590->576 623 401864-401865 590->623 601 401882-401888 591->601 605 402ace 601->605 603->604 607 4018d0-4018db CloseHandle 603->607 604->607 611 402ad0-402ad4 605->611 608 4018e1-4018e4 607->608 609 402ac5-402ac8 607->609 612 4018e6-4018f7 call 4062dc lstrcatW 608->612 613 4018f9-4018fc call 4062dc 608->613 609->605 619 401901-4022fc call 405920 612->619 613->619 619->609 619->611 623->601 625 401867-401868 623->625 625->591
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                              • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
                                                                                                                                                                                                                              • Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\), ref: 0040538F
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp$C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll$ExecShellAsUser
                                                                                                                                                                                                                            • API String ID: 1941528284-3087863059
                                                                                                                                                                                                                            • Opcode ID: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
                                                                                                                                                                                                                            • Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E
                                                                                                                                                                                                                            Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 627 406624-406644 GetSystemDirectoryW 628 406646 627->628 629 406648-40664a 627->629 628->629 630 40665b-40665d 629->630 631 40664c-406655 629->631 633 40665e-406691 wsprintfW LoadLibraryExW 630->633 631->630 632 406657-406659 631->632 632->633
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                            • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                            • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                            • Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                                                            • Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99
                                                                                                                                                                                                                            Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 634 403116-40312d 635 403136-40313f 634->635 636 40312f 634->636 637 403141 635->637 638 403148-40314d 635->638 636->635 637->638 639 40315d-40316a call 403331 638->639 640 40314f-403158 call 403347 638->640 644 403170-403174 639->644 645 40331f 639->645 640->639 646 4032ca-4032cc 644->646 647 40317a-4031c3 GetTickCount 644->647 648 403321-403322 645->648 649 40330c-40330f 646->649 650 4032ce-4032d1 646->650 651 403327 647->651 652 4031c9-4031d1 647->652 653 40332a-40332e 648->653 657 403311 649->657 658 403314-40331d call 403331 649->658 650->651 654 4032d3 650->654 651->653 655 4031d3 652->655 656 4031d6-4031e4 call 403331 652->656 659 4032d6-4032dc 654->659 655->656 656->645 668 4031ea-4031f3 656->668 657->658 658->645 666 403324 658->666 663 4032e0-4032ee call 403331 659->663 664 4032de 659->664 663->645 671 4032f0-4032f5 call 405e62 663->671 664->663 666->651 670 4031f9-403219 call 4067f5 668->670 676 4032c2-4032c4 670->676 677 40321f-403232 GetTickCount 670->677 675 4032fa-4032fc 671->675 678 4032c6-4032c8 675->678 679 4032fe-403308 675->679 676->648 680 403234-40323c 677->680 681 40327d-40327f 677->681 678->648 679->659 684 40330a 679->684 685 403244-40327a MulDiv wsprintfW call 405322 680->685 686 40323e-403242 680->686 682 403281-403285 681->682 683 4032b6-4032ba 681->683 688 403287-40328e call 405e62 682->688 689 40329c-4032a7 682->689 683->652 690 4032c0 683->690 684->651 685->681 686->681 686->685 694 403293-403295 688->694 693 4032aa-4032ae 689->693 690->651 693->670 695 4032b4 693->695 694->678 696 403297-40329a 694->696 695->651 696->693
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountTick$wsprintf
                                                                                                                                                                                                                            • String ID: ... %d%%
                                                                                                                                                                                                                            • API String ID: 551687249-2449383134
                                                                                                                                                                                                                            • Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                                                            • Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9
                                                                                                                                                                                                                            Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 697 401c1f-401c3f call 402c1f * 2 702 401c41-401c48 call 402c41 697->702 703 401c4b-401c4f 697->703 702->703 704 401c51-401c58 call 402c41 703->704 705 401c5b-401c61 703->705 704->705 708 401c63-401c7f call 402c1f * 2 705->708 709 401caf-401cd9 call 402c41 * 2 FindWindowExW 705->709 721 401c81-401c9d SendMessageTimeoutW 708->721 722 401c9f-401cad SendMessageW 708->722 720 401cdf 709->720 723 401ce2-401ce5 720->723 721->723 722->720 724 402ac5-402ad4 723->724 725 401ceb 723->725 725->724
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Timeout
                                                                                                                                                                                                                            • String ID: !
                                                                                                                                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                            • Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                                                            • Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19
                                                                                                                                                                                                                            Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 728 4023e4-402415 call 402c41 * 2 call 402cd1 735 402ac5-402ad4 728->735 736 40241b-402425 728->736 737 402427-402434 call 402c41 lstrlenW 736->737 738 402438-40243b 736->738 737->738 740 40243d-40244e call 402c1f 738->740 741 40244f-402452 738->741 740->741 745 402463-402477 RegSetValueExW 741->745 746 402454-40245e call 403116 741->746 750 402479 745->750 751 40247c-40255d RegCloseKey 745->751 746->745 750->751 751->735
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,00000023,00000011,00000002), ref: 0040242F
                                                                                                                                                                                                                            • RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,00000000,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseValuelstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp
                                                                                                                                                                                                                            • API String ID: 2655323295-320743480
                                                                                                                                                                                                                            • Opcode ID: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
                                                                                                                                                                                                                            • Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29
                                                                                                                                                                                                                            Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 753 4057f1-40583c CreateDirectoryW 754 405842-40584f GetLastError 753->754 755 40583e-405840 753->755 756 405869-40586b 754->756 757 405851-405865 SetFileSecurityW 754->757 755->756 757->755 758 405867 GetLastError 757->758 758->756
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405848
                                                                                                                                                                                                                            • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405867
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3449924974-0
                                                                                                                                                                                                                            • Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                                                            • Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9
                                                                                                                                                                                                                            Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 759 405c97-405cb2 call 4062ba call 405c3a 764 405cb4-405cb6 759->764 765 405cb8-405cc5 call 40654e 759->765 766 405d10-405d12 764->766 769 405cd5-405cd9 765->769 770 405cc7-405ccd 765->770 772 405cef-405cf8 lstrlenW 769->772 770->764 771 405ccf-405cd3 770->771 771->764 771->769 773 405cfa-405d0e call 405b8f GetFileAttributesW 772->773 774 405cdb-405ce2 call 4065fd 772->774 773->766 779 405ce4-405ce7 774->779 780 405ce9-405cea call 405bdb 774->780 779->764 779->780 780->772
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405CF0
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(00464250,00464250,00464250,00464250,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00405D00
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                            • String ID: PBF
                                                                                                                                                                                                                            • API String ID: 3248276644-3456974464
                                                                                                                                                                                                                            • Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                                                            • Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E
                                                                                                                                                                                                                            Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 782 405ddf-405deb 783 405dec-405e20 GetTickCount GetTempFileNameW 782->783 784 405e22-405e24 783->784 785 405e2f-405e31 783->785 784->783 786 405e26 784->786 787 405e29-405e2c 785->787 786->787
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00405DFD
                                                                                                                                                                                                                            • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9), ref: 00405E18
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountFileNameTempTick
                                                                                                                                                                                                                            • String ID: nsa
                                                                                                                                                                                                                            • API String ID: 1716503409-2209301699
                                                                                                                                                                                                                            • Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                                                            • Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64
                                                                                                                                                                                                                            Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                              • Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
                                                                                                                                                                                                                              • Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\), ref: 0040538F
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                              • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
                                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 334405425-0
                                                                                                                                                                                                                            • Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                                                            • Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E
                                                                                                                                                                                                                            Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalFree.KERNELBASE(008F8018), ref: 00401BE7
                                                                                                                                                                                                                            • GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFree
                                                                                                                                                                                                                            • String ID: ExecShellAsUser
                                                                                                                                                                                                                            • API String ID: 3394109436-869331269
                                                                                                                                                                                                                            • Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                                                            • Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D
                                                                                                                                                                                                                            Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
                                                                                                                                                                                                                              • Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614
                                                                                                                                                                                                                            • lstrlenW.KERNEL32 ref: 00402299
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00000000), ref: 004022A4
                                                                                                                                                                                                                            • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1486964399-0
                                                                                                                                                                                                                            • Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                                                            • Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59
                                                                                                                                                                                                                            Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
                                                                                                                                                                                                                              • Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4
                                                                                                                                                                                                                            • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
                                                                                                                                                                                                                            • DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1655745494-0
                                                                                                                                                                                                                            • Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
                                                                                                                                                                                                                            • Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE
                                                                                                                                                                                                                            Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                                                              • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                              • Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1892508949-0
                                                                                                                                                                                                                            • Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                                                            • Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E
                                                                                                                                                                                                                            Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3356406503-0
                                                                                                                                                                                                                            • Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                                                            • Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E
                                                                                                                                                                                                                            Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                            • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                                                            • Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C
                                                                                                                                                                                                                            Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 00405405
                                                                                                                                                                                                                              • Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                            • CoUninitialize.COMBASE(00000404,00000000), ref: 00405451
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: InitializeMessageSendUninitialize
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2896919175-0
                                                                                                                                                                                                                            • Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
                                                                                                                                                                                                                            • Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E
                                                                                                                                                                                                                            Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000000), ref: 00401E67
                                                                                                                                                                                                                            • EnableWindow.USER32(00000000,00000000), ref: 00401E72
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$EnableShow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1136574915-0
                                                                                                                                                                                                                            • Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                                                            • Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A
                                                                                                                                                                                                                            Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                              • Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                                                              • Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                                                              • Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2547128583-0
                                                                                                                                                                                                                            • Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                                                            • Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D
                                                                                                                                                                                                                            Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(?,004DF000,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403936
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1100898210-0
                                                                                                                                                                                                                            • Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
                                                                                                                                                                                                                            • Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8
                                                                                                                                                                                                                            Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                            • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AttributesCreate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 415043291-0
                                                                                                                                                                                                                            • Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                                                            • Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15
                                                                                                                                                                                                                            Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
                                                                                                                                                                                                                            • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                                                                                            • Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                                                            • Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98
                                                                                                                                                                                                                            Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1375471231-0
                                                                                                                                                                                                                            • Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                                                            • Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D
                                                                                                                                                                                                                            Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                                            • Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                                                                            • Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634
                                                                                                                                                                                                                            Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                                            • Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                                                            • Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4
                                                                                                                                                                                                                            Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2738559852-0
                                                                                                                                                                                                                            • Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                                                            • Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8
                                                                                                                                                                                                                            Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Open
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 71445658-0
                                                                                                                                                                                                                            • Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                                                            • Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14
                                                                                                                                                                                                                            Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemText
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3367045223-0
                                                                                                                                                                                                                            • Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                                                            • Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26
                                                                                                                                                                                                                            Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                                                            • Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C
                                                                                                                                                                                                                            Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                            • Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                                                            • Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D
                                                                                                                                                                                                                            Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                                                            • Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09
                                                                                                                                                                                                                            Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                                                            • Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19
                                                                                                                                                                                                                            Function 004038D0 Relevance: 1.3, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2962429428-0
                                                                                                                                                                                                                            • Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
                                                                                                                                                                                                                            • Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404CB6
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00404CC1
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
                                                                                                                                                                                                                            • LoadBitmapW.USER32(0000006E), ref: 00404D1E
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
                                                                                                                                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
                                                                                                                                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00404D94
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005), ref: 00404EEE
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
                                                                                                                                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 004050BE
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 004050CE
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
                                                                                                                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 0040526D
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 00405278
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 0040527F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                            • String ID: $M$N
                                                                                                                                                                                                                            • API String ID: 1638840714-813528018
                                                                                                                                                                                                                            • Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                                                            • Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58
                                                                                                                                                                                                                            Function 00404722 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404771
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 0040479B
                                                                                                                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 0040484C
                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404857
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7
                                                                                                                                                                                                                              • Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917
                                                                                                                                                                                                                              • Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                                                              • Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                                                              • Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                                                              • Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                                                            • GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
                                                                                                                                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985
                                                                                                                                                                                                                              • Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                                                              • Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                                                              • Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: A$Remove folder:
                                                                                                                                                                                                                            • API String ID: 2624150263-1936035403
                                                                                                                                                                                                                            • Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                                                            • Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D
                                                                                                                                                                                                                            Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1974802433-0
                                                                                                                                                                                                                            • Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                                                            • Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A
                                                                                                                                                                                                                            Function 00406B15 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                                                            • Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04
                                                                                                                                                                                                                            Function 004072EC Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                                                            • Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95
                                                                                                                                                                                                                            Function 004043F0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 004044A2
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 004044D0
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 004044F1
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 0040456C
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000), ref: 00404573
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040459E
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 004045F2
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 0040460E
                                                                                                                                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
                                                                                                                                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                            • String ID: N$Remove folder: $gC@
                                                                                                                                                                                                                            • API String ID: 3103080414-3559505530
                                                                                                                                                                                                                            • Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                                                            • Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99
                                                                                                                                                                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                            • DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                            • String ID: F
                                                                                                                                                                                                                            • API String ID: 941294808-1304234792
                                                                                                                                                                                                                            • Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                                                            • Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4
                                                                                                                                                                                                                            Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A
                                                                                                                                                                                                                              • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                                                              • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
                                                                                                                                                                                                                            • wsprintfA.USER32 ref: 00405F85
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
                                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 0040606E
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075
                                                                                                                                                                                                                              • Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                              • Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                            • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                            • API String ID: 2171350718-461813615
                                                                                                                                                                                                                            • Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                                                            • Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD
                                                                                                                                                                                                                            Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
                                                                                                                                                                                                                            • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\), ref: 0040538F
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                            • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\
                                                                                                                                                                                                                            • API String ID: 2531174081-961963844
                                                                                                                                                                                                                            • Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                                                            • Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8
                                                                                                                                                                                                                            Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 004042B5
                                                                                                                                                                                                                            • GetSysColor.USER32(00000000), ref: 004042F3
                                                                                                                                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 004042FF
                                                                                                                                                                                                                            • SetBkMode.GDI32(?,?), ref: 0040430B
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 0040431E
                                                                                                                                                                                                                            • SetBkColor.GDI32(?,?), ref: 0040432E
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00404348
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 00404352
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2320649405-0
                                                                                                                                                                                                                            • Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                                                            • Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54
                                                                                                                                                                                                                            Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A
                                                                                                                                                                                                                              • Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                            • String ID: 9
                                                                                                                                                                                                                            • API String ID: 163830602-2366072709
                                                                                                                                                                                                                            • Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                                                            • Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58
                                                                                                                                                                                                                            Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
                                                                                                                                                                                                                            • GetMessagePos.USER32 ref: 00404C0F
                                                                                                                                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404C29
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                            • String ID: f
                                                                                                                                                                                                                            • API String ID: 41195575-1993550816
                                                                                                                                                                                                                            • Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                                                            • Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4
                                                                                                                                                                                                                            Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDC.USER32(?), ref: 00401DBC
                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
                                                                                                                                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401DEF
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                            • String ID: MS Shell Dlg
                                                                                                                                                                                                                            • API String ID: 3808545654-76309092
                                                                                                                                                                                                                            • Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                                                            • Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D
                                                                                                                                                                                                                            Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
                                                                                                                                                                                                                            • MulDiv.KERNEL32(04E8D5EA,00000064,04E8D5EE), ref: 00402E3C
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00402E4C
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402E5C
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • verifying installer: %d%%, xrefs: 00402E46
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                            • String ID: verifying installer: %d%%
                                                                                                                                                                                                                            • API String ID: 1451636040-82062127
                                                                                                                                                                                                                            • Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                                                            • Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98
                                                                                                                                                                                                                            Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00402956
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402969
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2667972263-0
                                                                                                                                                                                                                            • Opcode ID: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
                                                                                                                                                                                                                            • Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98
                                                                                                                                                                                                                            Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                                                            • CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                                                            • CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                                                            • CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Char$Next$Prev
                                                                                                                                                                                                                            • String ID: *?|<>/":
                                                                                                                                                                                                                            • API String ID: 589700163-165019052
                                                                                                                                                                                                                            • Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                                                            • Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD
                                                                                                                                                                                                                            Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp$C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\StdUtils.dll
                                                                                                                                                                                                                            • API String ID: 3109718747-3917641215
                                                                                                                                                                                                                            • Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                                                            • Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D
                                                                                                                                                                                                                            Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401D63
                                                                                                                                                                                                                            • GetClientRect.USER32(00000000,?), ref: 00401D70
                                                                                                                                                                                                                            • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401DAE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1849352358-0
                                                                                                                                                                                                                            • Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                                                            • Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78
                                                                                                                                                                                                                            Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                            • String ID: %u.%u%s%s
                                                                                                                                                                                                                            • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                            • Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                                                            • Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8
                                                                                                                                                                                                                            Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Close$Enum
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 464197530-0
                                                                                                                                                                                                                            • Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
                                                                                                                                                                                                                            • Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68
                                                                                                                                                                                                                            Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402EAA
                                                                                                                                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2102729457-0
                                                                                                                                                                                                                            • Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                                                            • Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC
                                                                                                                                                                                                                            Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 004052C5
                                                                                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 00405316
                                                                                                                                                                                                                              • Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                            • Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                                                            • Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E
                                                                                                                                                                                                                            Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsoAF77.tmp\), ref: 004061D9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID: Remove folder:
                                                                                                                                                                                                                            • API String ID: 3356406503-1958208860
                                                                                                                                                                                                                            • Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
                                                                                                                                                                                                                            • Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4
                                                                                                                                                                                                                            Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 004058D9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Error launching installer, xrefs: 004058B6
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                            • String ID: Error launching installer
                                                                                                                                                                                                                            • API String ID: 3712363035-66219284
                                                                                                                                                                                                                            • Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                                                            • Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79
                                                                                                                                                                                                                            Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
                                                                                                                                                                                                                            • CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2050063315.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2049965422.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050496231.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2050912307.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2051857861.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_WeChat-Setup (3).jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 190613189-0
                                                                                                                                                                                                                            • Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                                                            • Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98