Tencent WeChat PC is suspected to be linked to Coinhive.A Trojan horse? false alarm

This article is from:Zhihu user, Chongmu, forwarded with authorization.

, forwarded with authorization.

Today, when I open WeChat on the PC side, the Windows 10 Firewall Defender keeps popping up this prompt, and it will not pop up after the WeChat PC side is closed:http://www.qq.comIf there is no interception will open

The official website, and the CPU often resources 100%.

Then check the details, a lot:

View details again:

Then look at this *675.dump file

Inside is the mining code of the CoinHive digital currency Monero.

There is also a wallet address 9pFICAsxNfFPjTILDGhD5D3jqkAqDRND in it

The linked horse address inside is from Tencent Cloud 182.254.78.140

At present, this phenomenon has been released on multiple users' computers, and the above problems have been reported to Tencent Cloud operators (people in the WeChat department do not know...). Hope to resolve it soon.