fatalrat | b360f349017399408e0680d71b9c3e774a89ae19259a8396e697fccb18867960

Analysis

max time kernel
515s
max time network
517s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
06-08-2023 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Whatsapp.msi
Size

162.7MB
MD5

efa5dbed98ee67aaad29dcb32a333ef4
SHA1

cdd185b6c158052fb7d888d0ba2ec0a164843f6f
SHA256

b360f349017399408e0680d71b9c3e774a89ae19259a8396e697fccb18867960
SHA512

9b4fd7bdf60489ad2b6fdd9863a035a7395f6ca462be190083295faff90c365468e3207b5acc1cc95a71f060b8185e53514a8e5c2c7deceec064895814ded0a4
SSDEEP

3145728:VObD8Na5QkjrDpgCbheTWyGYsl2cH5+3StNEkt8KFMOBFilcg5hYiHa8+8Vo6:VcDuaWsPp/tIGYsl2S+3StNAKlsLhZzx

Score

10^/10

fatalrat infostealer persistence rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/3628-12718-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

Executes dropped EXE 11 IoCs

pid	Process
2948	u9.exe
3628	spolsvt.exe
4776	elf.exe
2248	WhatsApp.exe
4428	WhatsApp.exe
2316	WhatsApp.exe
4716	Update.exe
4764	WhatsApp.exe
3044	WhatsApp.exe
2948	WhatsApp.exe
3808	Update.exe

Loads dropped DLL 29 IoCs

pid	Process
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4840	MsiExec.exe
4840	MsiExec.exe
4840	MsiExec.exe
4840	MsiExec.exe
4736	MsiExec.exe
2948	u9.exe
4776	elf.exe
4736	MsiExec.exe
4736	MsiExec.exe
2248	WhatsApp.exe
2248	WhatsApp.exe
2316	WhatsApp.exe
4428	WhatsApp.exe
4428	WhatsApp.exe
4428	WhatsApp.exe
4764	WhatsApp.exe
3044	WhatsApp.exe
3044	WhatsApp.exe
2948	WhatsApp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrobot = "C:\\Users\\Admin\\Documents\\robot\\elf.exe"	elf.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe
2948	u9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 3628	2948	u9.exe	83

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\it.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ro.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\uk.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\ql-win32\bin\win32-x64-87\ql-win32.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\chrome_100_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\el.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\hu.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\squirrel.exe	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\SquirrelSetup.log	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\wavoip\build\Release\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\windows-quiet-hours\bin\win32-x64-87\windows-quiet-hours.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\vulkan-1.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app.ico	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\am.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\en-GB.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ru.pak	msiexec.exe
File opened for modification	C:\Program Files (x86)\WhatsApp\WhatsApp plus\SquirrelSetup.log	Update.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\zh-CN.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\packages\.betaId	Update.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ta.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\th.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\tr.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\he.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\nl.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\node-shared-mem\bin\win32-x64-87\node-shared-mem.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\de.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\en-US.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\es-419.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\windows-quiet-hours\build\Release\quiethours.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\SquirrelSetup.log	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\gu.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\nb.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\pl.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\pt-BR.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\sv.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\chrome_200_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\bg.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\fil.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\zh-TW.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\electron-panel-window\bin\win32-x64-87\electron-panel-window.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\vk_swiftshader.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\libEGL.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ja.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\sk.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ca.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\lt.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\id.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\mr.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\node-quarantine\bin\win32-x64-87\node-quarantine.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\wavoip\build\Release\binding.node	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\wavoip\build\Release\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\es.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\et.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\fa.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\ffmpeg.dll	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\ar.pak	msiexec.exe
File created	C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\node-quarantine\build\Release\binding.node	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC5FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58c272.msi	msiexec.exe
File created	C:\Windows\Installer\e58c270.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c270.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC494.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8F8EB75E-D7C7-4B2A-BBD4-3CC4F98C7AA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC38A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC551.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E57BE8F87C7DA2B4BB4DC34C9FC8A77A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\jF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\PackageName = "Whatsapp.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\ProductName = "WhatsApp plus"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp	WhatsApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\shell\open\command\ = "\"C:\\Program Files (x86)\\WhatsApp\\WhatsApp plus\\app-2.2310.5\\WhatsApp.exe\" \"%1\""	WhatsApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\PackageCode = "11FE28F678602204588BDDDE05E5B591"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB6F8A2A053124E4D835B0A95DA361FB	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\URL Protocol	WhatsApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\ = "URL:whatsapp"	WhatsApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\shell\open	WhatsApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\shell\open\command	WhatsApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000_Classes\whatsapp\shell	WhatsApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB6F8A2A053124E4D835B0A95DA361FB\E57BE8F87C7DA2B4BB4DC34C9FC8A77A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E57BE8F87C7DA2B4BB4DC34C9FC8A77A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4036	msiexec.exe
4036	msiexec.exe
2948	u9.exe
2948	u9.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe
3628	spolsvt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	4036	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeMachineAccountPrivilege	5016	msiexec.exe
Token: SeTcbPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeLoadDriverPrivilege	5016	msiexec.exe
Token: SeSystemProfilePrivilege	5016	msiexec.exe
Token: SeSystemtimePrivilege	5016	msiexec.exe
Token: SeProfSingleProcessPrivilege	5016	msiexec.exe
Token: SeIncBasePriorityPrivilege	5016	msiexec.exe
Token: SeCreatePagefilePrivilege	5016	msiexec.exe
Token: SeCreatePermanentPrivilege	5016	msiexec.exe
Token: SeBackupPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeDebugPrivilege	5016	msiexec.exe
Token: SeAuditPrivilege	5016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5016	msiexec.exe
Token: SeChangeNotifyPrivilege	5016	msiexec.exe
Token: SeRemoteShutdownPrivilege	5016	msiexec.exe
Token: SeUndockPrivilege	5016	msiexec.exe
Token: SeSyncAgentPrivilege	5016	msiexec.exe
Token: SeEnableDelegationPrivilege	5016	msiexec.exe
Token: SeManageVolumePrivilege	5016	msiexec.exe
Token: SeImpersonatePrivilege	5016	msiexec.exe
Token: SeCreateGlobalPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeMachineAccountPrivilege	5016	msiexec.exe
Token: SeTcbPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeLoadDriverPrivilege	5016	msiexec.exe
Token: SeSystemProfilePrivilege	5016	msiexec.exe
Token: SeSystemtimePrivilege	5016	msiexec.exe
Token: SeProfSingleProcessPrivilege	5016	msiexec.exe
Token: SeIncBasePriorityPrivilege	5016	msiexec.exe
Token: SeCreatePagefilePrivilege	5016	msiexec.exe
Token: SeCreatePermanentPrivilege	5016	msiexec.exe
Token: SeBackupPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeDebugPrivilege	5016	msiexec.exe
Token: SeAuditPrivilege	5016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5016	msiexec.exe
Token: SeChangeNotifyPrivilege	5016	msiexec.exe
Token: SeRemoteShutdownPrivilege	5016	msiexec.exe
Token: SeUndockPrivilege	5016	msiexec.exe
Token: SeSyncAgentPrivilege	5016	msiexec.exe
Token: SeEnableDelegationPrivilege	5016	msiexec.exe
Token: SeManageVolumePrivilege	5016	msiexec.exe
Token: SeImpersonatePrivilege	5016	msiexec.exe
Token: SeCreateGlobalPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5016	msiexec.exe
5016	msiexec.exe
2248	WhatsApp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2948	u9.exe
2948	u9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4736	4036	msiexec.exe	71
PID 4036 wrote to memory of 4736	4036	msiexec.exe	71
PID 4036 wrote to memory of 4736	4036	msiexec.exe	71
PID 4036 wrote to memory of 4436	4036	msiexec.exe	75
PID 4036 wrote to memory of 4436	4036	msiexec.exe	75
PID 4036 wrote to memory of 4840	4036	msiexec.exe	77
PID 4036 wrote to memory of 4840	4036	msiexec.exe	77
PID 4036 wrote to memory of 4840	4036	msiexec.exe	77
PID 4736 wrote to memory of 2948	4736	MsiExec.exe	79
PID 4736 wrote to memory of 2948	4736	MsiExec.exe	79
PID 4736 wrote to memory of 2948	4736	MsiExec.exe	79
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 3628	2948	u9.exe	83
PID 2948 wrote to memory of 4776	2948	u9.exe	84
PID 2948 wrote to memory of 4776	2948	u9.exe	84
PID 2948 wrote to memory of 4776	2948	u9.exe	84
PID 2948 wrote to memory of 784	2948	u9.exe	85
PID 2948 wrote to memory of 784	2948	u9.exe	85
PID 2948 wrote to memory of 784	2948	u9.exe	85
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88
PID 2248 wrote to memory of 4428	2248	WhatsApp.exe	88

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Whatsapp.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35D76F6123415FCBFDBB91C274969A77 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Public\jF\u9.exe
    "C:\Users\Public\jF\u9.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Public\Documents\t\spolsvt.exe
      C:\Users\Public\Documents\t\spolsvt.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3628
  - - C:\Users\Admin\Documents\robot\elf.exe
      "C:\Users\Admin\Documents\robot\elf.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      PID:4776
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c del u9.exe
      4⤵
      PID:784
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4436
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C3DE870336B3272D3EDFF00B509966FA
  2⤵
  - Loads dropped DLL
  PID:4840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Modifies data under HKEY_USERS
PID:3600

C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
"C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe" --type=gpu-process --field-trial-handle=1524,349781558816664895,8069814279302260444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1532 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4428
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\WhatsApp /prefetch:7 --no-rate-limit --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\WhatsApp\Crashpad --url=https://crashlogs.whatsapp.net/wa_clb_data?access_token=1063127757113399%7C745146ffa34413f9dbb5469f5370b7af --annotation=_productName=WhatsApp --annotation=_version=2.2310.5 --annotation=prod=Electron --annotation=ver=12.2.3 --initial-client-data=0x654,0x658,0x65c,0x650,0x660,0x7ff6e2b62bc0,0x7ff6e2b62bd0,0x7ff6e2b62be0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2316
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\Update.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\Update.exe" --checkForUpdate https://web.whatsapp.com/desktop/windows/release/x64?version=2.2310.5
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4716
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,349781558816664895,8069814279302260444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=whatsapp --secure-schemes=whatsapp --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4764
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1524,349781558816664895,8069814279302260444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --standard-schemes=whatsapp --secure-schemes=whatsapp --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.squirrel.WhatsApp.WhatsApp --app-path="C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe csproduct get /value"
  2⤵
  PID:3420
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe csproduct get /value
    3⤵
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
  2⤵
  PID:2488
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
    3⤵
    PID:3092
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1524,349781558816664895,8069814279302260444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --standard-schemes=whatsapp --secure-schemes=whatsapp --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2948
- C:\Program Files (x86)\WhatsApp\WhatsApp plus\Update.exe
  "C:\Program Files (x86)\WhatsApp\WhatsApp plus\Update.exe" --checkForUpdate https://web.whatsapp.com/desktop/windows/release/x64?version=2.2310.5
  2⤵
  - Executes dropped EXE
  PID:3808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2dc
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58c271.rbs

Filesize
23KB

MD5
57ba85a72a17dfc4a810bb47ddcf2227

SHA1
a272496d600fa877412929191127285b29755a03

SHA256
616d4d316a1d6f395bd95941d9efeb0b9621c1058111b75dd7ace4217778eb24

SHA512
4c5823b6b36434b08f3ceac76ceb438e4418c8c965227fed05bddca80e7df7552eb8a1e3e8295adbfd51ccf604f2858c5d637b27cd4c6517d888f05c0d909c37

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe

Filesize
125.4MB

MD5
1157e62b77b905f01f99388fea1c933a

SHA1
bb8b87655f2e634bb90a964f00690b9aa9f044bf

SHA256
288dce85890e7c5350886b082eb20e3b19159906c3431e6e81a54c95cf722760

SHA512
bd1fe6961d03ea5bfaa1fc0bd9962ecc7c97d5bbd9644b07f6378e7648b582f71a63c56f82a635aebee5b3a9b3b8159ef6021d1bf348bb3d7e9ecb5def43b1bf

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe

Filesize
125.4MB

MD5
1157e62b77b905f01f99388fea1c933a

SHA1
bb8b87655f2e634bb90a964f00690b9aa9f044bf

SHA256
288dce85890e7c5350886b082eb20e3b19159906c3431e6e81a54c95cf722760

SHA512
bd1fe6961d03ea5bfaa1fc0bd9962ecc7c97d5bbd9644b07f6378e7648b582f71a63c56f82a635aebee5b3a9b3b8159ef6021d1bf348bb3d7e9ecb5def43b1bf

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\WhatsApp.exe

Filesize
125.4MB

MD5
1157e62b77b905f01f99388fea1c933a

SHA1
bb8b87655f2e634bb90a964f00690b9aa9f044bf

SHA256
288dce85890e7c5350886b082eb20e3b19159906c3431e6e81a54c95cf722760

SHA512
bd1fe6961d03ea5bfaa1fc0bd9962ecc7c97d5bbd9644b07f6378e7648b582f71a63c56f82a635aebee5b3a9b3b8159ef6021d1bf348bb3d7e9ecb5def43b1bf

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\chrome_100_percent.pak

Filesize
123KB

MD5
a59ea69d64bf4f748401dc5a46a65854

SHA1
111c4cc792991faf947a33386a5862e3205b0cff

SHA256
f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9

SHA512
12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\chrome_200_percent.pak

Filesize
183KB

MD5
1985b8fc603db4d83df72cfaeeac7c50

SHA1
5b02363de1c193827062bfa628261b1ec16bd8cf

SHA256
7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b

SHA512
27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\ffmpeg.dll

Filesize
2.7MB

MD5
5963feb848d7dc57541c041bc6f7539e

SHA1
fc2d66b84a003192b9ce2536c7bd2351eddfcd47

SHA256
1817f50f1bc77c512149d6be845a420eac4be4c2f3233ade61f61d77f8f87dbd

SHA512
0948b13487cc949a1d37e98f7605110c8b581d94a2ee8d16cdab1ea159d82e8b7dd636025246b95d3d7f9f33a0ce7ff8a9e262756badfc8e8a3f5a6dc09de38a

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\icudtl.dat

Filesize
9.9MB

MD5
70499b58dc18e7ee1d7452a1d7a8bc6e

SHA1
41c5382f08c6a88670ce73a20c0dcdb3822f19e9

SHA256
02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0

SHA512
a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\locales\en-US.pak

Filesize
85KB

MD5
6bbeeb72daebc3b0cbd9c39e820c87a9

SHA1
bd9ebec2d3fc03a2b27f128cf2660b33a3344f43

SHA256
ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b

SHA512
66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources.pak

Filesize
4.9MB

MD5
5507bc28022b806ea7a3c3bc65a1c256

SHA1
9f8d3a56fef7374c46cd3557f73855d585692b54

SHA256
367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df

SHA512
ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar

Filesize
252.9MB

MD5
8adfcf5e1c94cb641af975373fc2a013

SHA1
a68b1d6c064395a3b2bc60bd94972f3806c76c4a

SHA256
64d2951477c43e59944f7b169de2d22fdcd342d4d75b9d582d789d0330d62add

SHA512
eb41113e5aab37a72a248fd5943fe256a26bfb19f14fa00f781287096defc5b10d9e0f8665fad6068ed3f565c1623e71afbe380180369c4fe36d117971c4cd09

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node

Filesize
632KB

MD5
b7ab76624efc7219962eacbfdf231b41

SHA1
f7ff359cd7aa0d39d26687cc7014dedd2738ad53

SHA256
56c3f149c7811c81f6129896d2f06c6052d7bd85c20c4c26f65539db2c33fba1

SHA512
472851b0ad5f8f11e7143bb7ceeb5cde58c6613a3be7fb3f356c6eae2a90fe0972c50bbf6ce511e9b57a9242aa7a8fb727b024a20fa4e803bd3772a2cd71945a

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\v8_context_snapshot.bin

Filesize
160KB

MD5
b64c1fc7d75234994012c86dc5af10a6

SHA1
d0d562b5735d28381d59d0d86078ff6b493a678e

SHA256
31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790

SHA512
6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a

Download Submit
C:\Program Files (x86)\WhatsApp\WhatsApp plus\update.exe

Filesize
2.1MB

MD5
94bf0cf7fb285fa7e336ec30e3994e22

SHA1
8475fbbe356791d40fc873ef3cc9f554ee15a49b

SHA256
62ebeaf33b43417b99ea8e918b41c8c9a0d6acc53d47dd450de99f8ddbb9fa11

SHA512
8b71326289a3228e127a87b66a1002ee54ef5cdd3d9beedd26ec02dff70ec689f326dd652f1c8b377d78a58a0ca027ac7fcecbd8be70b686d1201b549a398726

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI418F.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI423C.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI423C.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4376.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI822E.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8927.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICED9.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID061.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID0DF.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID0DF.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID18B.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID332.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID3DF.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID690.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE99.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\IndexedDB\file__0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Network Persistent State

Filesize
184B

MD5
e8c80349c3fd50606dd0ef8faf0b41cf

SHA1
dd57a9c87a2d3b745165616487c29243727e38e9

SHA256
4c7534eaa1b0e94bf5b49acccac70c3ded62f2e345c1c19dfcbff078f03366a9

SHA512
b76b26f6ead4d2559449885f1a3c6dde1c5c1098a0e9f06bd3e8a5b36fb25b632c4fee064617246b17748bd081e5e58b3c0756cd17e0356205cd4ce8710c4f70

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Network Persistent State~RFe5b5b9a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\1fc3e15d-05c2-40ed-a365-d42372c8cf8b\index-dir\the-real-index

Filesize
96B

MD5
6fe6fd7285f573b6c8be58eec7cf4160

SHA1
6ec5a383035863611300a60f9133407ce299ba13

SHA256
5d9c930ec38dbd499ee7635157b77102c01693debec5a0f46eb93015f35e4a82

SHA512
70372d2dc63083819ff263a8c355c5e3cfc09b19dab30860720a72cbf0adc3b2ad3bf5783a0b5e6099ca68fc62357e80ba8efd9f332390d375b275ababe0550d

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\1fc3e15d-05c2-40ed-a365-d42372c8cf8b\index-dir\the-real-index~RFe5b5b8a.TMP

Filesize
48B

MD5
9c1559fbf32a4da210db714eb4472114

SHA1
12c2f36d10d3210b7a13f47744d37b781b63e7b9

SHA256
b4f6e2edf5e27428d220f2f03d9691521e489e546825029f463f5e4ded8119a1

SHA512
26edfa0ce32d6a25bc72e2729b48cfa0c25de960046fc16c84fd7b1f2f93775cd55d757392014c552d0bf1611009809dfacc05ee3d444275e27a0e04e6a35d49

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
112B

MD5
bd3a40208ea8f411c46aaab14f426273

SHA1
b7e9e4857141d8099a07298e1263ef5caad59266

SHA256
da8108113d3d06483ce38c2aac7e245def6276bd242bb04d30bdca483e01cfd7

SHA512
b0294abfb8b4dfb036d5bdc15a574236d92036be3f520c066e2f1dbc7d337e3de0d2a5f8b506828488981ed1007a2ba31b26596045fc4f6c16102875ff787cf2

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
106B

MD5
a280eaad2645cb8148404be0022ad1ff

SHA1
aac58e24773825a95a32af765ccf107b6bc83265

SHA256
12f177f902d970a1c79d39212e8be221a9141306a11f032e6a25261ed393c6c7

SHA512
a27e9c7122ff7485facfcad84c2badba7026004c77a3402d51a56a4ecc0353a87fb21a2e46e720763b1b1f0eca0b73232488a390dacbde490b07144150797c5c

Download Submit
C:\Users\Admin\Documents\robot\LoggerCollector.dll

Filesize
510KB

MD5
47fe0ab041a9c28fe838eb1b11556e33

SHA1
b7128f679230730cf477f3c081235de118c98960

SHA256
29fc393b56fcfa4a242c7bc5177b0861072f35c7c8be2546115e0f34d059e2bf

SHA512
7191170e244dac3b176bf89c67511b5938751471d84f73c58c3ff7fef3e6e1e70c3af5d3143cf3b66be461152b80845231fc6a3fafc31328193d47edd2961a40

Download Submit
C:\Users\Admin\Documents\robot\elf.exe

Filesize
2.2MB

MD5
33922d12e5bb8f40ecddf816124ae93d

SHA1
28244217fa205f12cf40278e97a3a01e6d7366a3

SHA256
255e4c5b81ddabc02455b7b4560e168b4064e63ec3721230201d1a7928c9f158

SHA512
1fdc906fdf3a89105d8e8996ec58e26e4d802fbbc99004d2f9a13a94cabeabde104fd55135763d5b959d1741d53e06ca18879407864c1e37e0a8764df9ea1973

Download Submit
C:\Users\Admin\Documents\robot\elf.exe

Filesize
2.2MB

MD5
33922d12e5bb8f40ecddf816124ae93d

SHA1
28244217fa205f12cf40278e97a3a01e6d7366a3

SHA256
255e4c5b81ddabc02455b7b4560e168b4064e63ec3721230201d1a7928c9f158

SHA512
1fdc906fdf3a89105d8e8996ec58e26e4d802fbbc99004d2f9a13a94cabeabde104fd55135763d5b959d1741d53e06ca18879407864c1e37e0a8764df9ea1973

Download Submit
C:\Users\Admin\Documents\robot\skin\Robot\Robot.xml

Filesize
260B

MD5
2fdb0ba1aa4f2088d10468757490b3fc

SHA1
3757f286d6fa2585747bf6135eb8c927bc3145b8

SHA256
6f1d5abe5173cab5a5d5553d6ebf4c78f0b0d587337c8c942c170acf24d9f02a

SHA512
aba55dd158a645d76c05c5b4e226547b42619f123de30050963cced626b914dce7c79574eca4f222b6eaae3a0acfd737818a423fc4bdf1402a31979f859fdaaa

Download Submit
C:\Users\Admin\Documents\robot\skin\Robot\icon_wnd.xml

Filesize
629B

MD5
f74ff1f559d4f5a7af7b09b00d17a3f7

SHA1
7ae57ae206977eb874cf1037e7dedb37cb464e4b

SHA256
1ebba2b9a0d222642016121ca19ee5cd6d1b32f40b43bd57aed165dc8dcdf781

SHA512
fc26f6af3c8e0d642a91e31e5060db94d7ed2cce33619a4d8e9b78c68b95b397db15863165ce536fbc364f2e361772ffb86be61e3d9a921011f167ca9c9d9c51

Download Submit
C:\Users\Admin\Documents\robot\skin\Robot\push_wnd.xml

Filesize
1KB

MD5
ee58358ad4380ad0da672cdb49247454

SHA1
e99376e5eaa92538221789ff8f25768d83f0cf1e

SHA256
633b462f98038aa0f9ab302d3cd0def8352fde79990af747b3c97b49ebab2103

SHA512
eded6474a11deb02292682e3354b2d7d17ac898348f533fc13a74451fb5a312ec25a0de69bd40d2b9a4159e2284834277b47072b2e8990780f6783519b0dfda3

Download Submit
C:\Users\Admin\Documents\robot\skin\mainres.xml

Filesize
671B

MD5
47fb824e5df4deb39e5b5342e833d8e4

SHA1
3196520d4dabefd5b4eb6c689210d5ce459476da

SHA256
04fb5ba3130fb6cb99ce5d5ffa11a8df2d2c02fcb9dd3517d691bf97e0369289

SHA512
fb64455995630400f73a4725e365e44c8d77dd1ccb534c2ba8a0ff50cf42c9b838abe7bf63e98596bc40466a3c7eafda29d7981564684772afd3cba136e6bb42

Download Submit
C:\Users\Admin\Documents\robot\switch.json

Filesize
142B

MD5
66fc880f0f331d0b1abb98f511e831fd

SHA1
230b04ccadbf2a586e25f5bc46940f6e7cc60edb

SHA256
87fa2ca07ca9ad4655d2dcd924ff56897e621f5a1d22ec1f9b49ba6cd8a3c090

SHA512
3926b2c951d604a45fe7fffa817beeb99408537cf12a97157c5f3cb6903af5c269d984f219ad37300f213dc26e01454fb33a9d4341948dbf3d00d68ec322a817

Download Submit
C:\Users\Public\Documents\t\spolsvt.exe

Filesize
16KB

MD5
cdce4713e784ae069d73723034a957ff

SHA1
9a393a6bab6568f1a774fb753353223f11367e09

SHA256
b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

SHA512
0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

Download Submit
C:\Users\Public\Documents\t\spolsvt.exe

Filesize
16KB

MD5
cdce4713e784ae069d73723034a957ff

SHA1
9a393a6bab6568f1a774fb753353223f11367e09

SHA256
b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

SHA512
0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

Download Submit
C:\Users\Public\jF\UnRAR.dll

Filesize
278KB

MD5
c5587655293f83c72f0c88c74660dd10

SHA1
675d7cac72e4caebebd7c2a88403d138b69acd89

SHA256
a647aec65edb9736ad9bbc60a99779d18438b783b3a7045533de97ba4134f4fe

SHA512
6b275764ba29dd5d2f789107de1b98095f42fe4929b725b5599136a6a626e32432fcb223ce1cf89050874102f0d24e6911c170e4d50a023dab4604c383380fd1

Download Submit
C:\Users\Public\jF\u9.exe

Filesize
4.5MB

MD5
92bd14c4a22b2aed0fe832f2b1174af0

SHA1
f08d2d2e6a6ffc92a7133d0ceaf01963cfaebe86

SHA256
7107606074d34bfb3d9a659b21bf84e55692b810b8e7d60c677b86b6477fdd7a

SHA512
bbc16c3595cf20a6aec3811975d8ae4121220f4549456dca9a4cc03e0d13131139736fa669d0dd941052f0cee25cf7d6d251e5cc61e34a22e712b19751c68b6a

Download Submit
C:\Users\Public\jF\u9.exe

Filesize
4.5MB

MD5
92bd14c4a22b2aed0fe832f2b1174af0

SHA1
f08d2d2e6a6ffc92a7133d0ceaf01963cfaebe86

SHA256
7107606074d34bfb3d9a659b21bf84e55692b810b8e7d60c677b86b6477fdd7a

SHA512
bbc16c3595cf20a6aec3811975d8ae4121220f4549456dca9a4cc03e0d13131139736fa669d0dd941052f0cee25cf7d6d251e5cc61e34a22e712b19751c68b6a

Download Submit
C:\Windows\Installer\MSIC38A.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Windows\Installer\MSIC494.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
C:\Windows\Installer\MSIC551.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Windows\Installer\MSIC5FE.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
C:\Windows\Installer\e58c270.msi

Filesize
162.7MB

MD5
efa5dbed98ee67aaad29dcb32a333ef4

SHA1
cdd185b6c158052fb7d888d0ba2ec0a164843f6f

SHA256
b360f349017399408e0680d71b9c3e774a89ae19259a8396e697fccb18867960

SHA512
9b4fd7bdf60489ad2b6fdd9863a035a7395f6ca462be190083295faff90c365468e3207b5acc1cc95a71f060b8185e53514a8e5c2c7deceec064895814ded0a4

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
1445337c61e46764fad7fb013c320b90

SHA1
01ca7cb1042252885c304566f54e0542c75c434c

SHA256
6b9d14b2a4ff91a21a7b90628599d048685189d70fc0fbfca32000cadaa8d63d

SHA512
61798db208007fc70f27b9232f9010f68eec603876b1f01ed2fca89d769810cd6b4fbf32a41a02d44896fc4aae76675b75e8cf7ceb0fa84514919e4542d8162d

Download Submit
\??\Volume{96faa851-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a3ecc10a-f340-46d1-ab55-bcdd7cbbd4d9}_OnDiskSnapshotProp

Filesize
5KB

MD5
2ba3373520272e18b897152e7ce6db21

SHA1
4247b8d839810b970c2fb15f9c3feb19a0d22050

SHA256
53edb7426ab075398e4de66f07bc15ae9227ac8b882a82fa7fed55a25e162557

SHA512
ab26ebd958a6a45e4c8ae1a01bf8166220b1006d7a43cef641f16784cfbf4b5156f6888dff78f281b654ed437c5e5e2f514b580a36e0c72594826ecdf20bc33b

Download Submit
\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\ffmpeg.dll

Filesize
2.7MB

MD5
5963feb848d7dc57541c041bc6f7539e

SHA1
fc2d66b84a003192b9ce2536c7bd2351eddfcd47

SHA256
1817f50f1bc77c512149d6be845a420eac4be4c2f3233ade61f61d77f8f87dbd

SHA512
0948b13487cc949a1d37e98f7605110c8b581d94a2ee8d16cdab1ea159d82e8b7dd636025246b95d3d7f9f33a0ce7ff8a9e262756badfc8e8a3f5a6dc09de38a

Download Submit
\Program Files (x86)\WhatsApp\WhatsApp plus\app-2.2310.5\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node

Filesize
632KB

MD5
b7ab76624efc7219962eacbfdf231b41

SHA1
f7ff359cd7aa0d39d26687cc7014dedd2738ad53

SHA256
56c3f149c7811c81f6129896d2f06c6052d7bd85c20c4c26f65539db2c33fba1

SHA512
472851b0ad5f8f11e7143bb7ceeb5cde58c6613a3be7fb3f356c6eae2a90fe0972c50bbf6ce511e9b57a9242aa7a8fb727b024a20fa4e803bd3772a2cd71945a

Download Submit
\Users\Admin\AppData\Local\Temp\MSI418F.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSI423C.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4376.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSI822E.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8927.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSICED9.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSID061.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSID0DF.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSID18B.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSID332.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\AppData\Local\Temp\MSID3DF.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSID690.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIFE99.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Users\Admin\Documents\robot\LoggerCollector.dll

Filesize
510KB

MD5
47fe0ab041a9c28fe838eb1b11556e33

SHA1
b7128f679230730cf477f3c081235de118c98960

SHA256
29fc393b56fcfa4a242c7bc5177b0861072f35c7c8be2546115e0f34d059e2bf

SHA512
7191170e244dac3b176bf89c67511b5938751471d84f73c58c3ff7fef3e6e1e70c3af5d3143cf3b66be461152b80845231fc6a3fafc31328193d47edd2961a40

Download Submit
\Users\Public\jF\UnRAR.dll

Filesize
278KB

MD5
c5587655293f83c72f0c88c74660dd10

SHA1
675d7cac72e4caebebd7c2a88403d138b69acd89

SHA256
a647aec65edb9736ad9bbc60a99779d18438b783b3a7045533de97ba4134f4fe

SHA512
6b275764ba29dd5d2f789107de1b98095f42fe4929b725b5599136a6a626e32432fcb223ce1cf89050874102f0d24e6911c170e4d50a023dab4604c383380fd1

Download Submit
\Windows\Installer\MSIC38A.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Windows\Installer\MSIC494.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Windows\Installer\MSIC551.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
\Windows\Installer\MSIC5FE.tmp

Filesize
705KB

MD5
f7b1ddc86cd51e3391aa8bf4be48d994

SHA1
a0c0a4a77991d7f8df722acdd782310a6da2a904

SHA256
ac2df3283d65ab78ca399232fa090764636e0fec7ab53be28f6ee93733d8787f

SHA512
f853c3cf9ec175e946dd42f7f35d130f4fb941f64bbf5780ce452fe6e87459217b80872db375ad1bbafc47ad263408e4222d81f62c7df92c77e23e77e67e6fa6

Download Submit
memory/2948-12794-0x0000000002660000-0x0000000002733000-memory.dmp

Filesize
844KB

Download
memory/2948-12724-0x0000000002B80000-0x0000000002D44000-memory.dmp

Filesize
1.8MB

Download
memory/2948-12767-0x0000000002800000-0x000000000299F000-memory.dmp

Filesize
1.6MB

Download
memory/2948-12793-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/2948-12708-0x00000000029A0000-0x0000000002AE5000-memory.dmp

Filesize
1.3MB

Download
memory/2948-317-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/2948-320-0x0000000075F30000-0x00000000760F2000-memory.dmp

Filesize
1.8MB

Download
memory/2948-4049-0x0000000002B80000-0x0000000002D44000-memory.dmp

Filesize
1.8MB

Download
memory/2948-4051-0x0000000077030000-0x000000007716C000-memory.dmp

Filesize
1.2MB

Download
memory/2948-4050-0x0000000002800000-0x000000000299F000-memory.dmp

Filesize
1.6MB

Download
memory/2948-5840-0x0000000075D70000-0x0000000075DE7000-memory.dmp

Filesize
476KB

Download
memory/2948-12707-0x0000000002660000-0x0000000002733000-memory.dmp

Filesize
844KB

Download
memory/3628-12713-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3628-12711-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3628-12712-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3628-12717-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3628-12718-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/3808-12925-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/3808-12927-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3808-12974-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/4428-12824-0x00007FF8A4020000-0x00007FF8A4021000-memory.dmp

Filesize
4KB

Download
memory/4716-12873-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/4716-12857-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4716-12856-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/4716-12848-0x0000000000070000-0x000000000029A000-memory.dmp

Filesize
2.2MB

Download