f256276c0af25e87b13a8c874bfa1e4ed3550aa17cab338b2c2a032ab50b37be

Analysis

max time kernel
242s
max time network
306s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
26-08-2023 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MeiqiaWinLatest.exe
Size

162.7MB
MD5

ac5307b8067f840e6c051cd455a76072
SHA1

080bccef6820955788c23b700a9dc2256f490ebc
SHA256

f256276c0af25e87b13a8c874bfa1e4ed3550aa17cab338b2c2a032ab50b37be
SHA512

24fb06453b8e056cc90c26041b195e37296974ec9f2723b77d1092872ebab6c0b71ddb95d364d1a852ebf586771feebfa1681ecfdb385d0c0e5d57a30b04361b
SSDEEP

3145728:NBt+6r/LUar8YAliZQgkSN680ZDjAVRIw5WC7R/YLtZME8ahgcAnHBnc2C:N/+6k4Z9kE6DGIRCV/ct+NarAnHxpC

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Executes dropped EXE 10 IoCs

Processes:

heoft.exeAliIM.exeWhatsApp.exeUpdate.exeSquirrel.exeWhatsApp.exeWhatsApp.exeWhatsApp.exeUpdate.exeWhatsApp.exe

pid	process
1288	heoft.exe
5028	AliIM.exe
656	WhatsApp.exe
224	Update.exe
2460	Squirrel.exe
888	WhatsApp.exe
2000	WhatsApp.exe
2560	WhatsApp.exe
2840	Update.exe
1464	WhatsApp.exe

Loads dropped DLL 19 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeAliIM.exeWhatsApp.exeWhatsApp.exeWhatsApp.exeWhatsApp.exe

pid	process
1084	MsiExec.exe
708	MsiExec.exe
708	MsiExec.exe
708	MsiExec.exe
708	MsiExec.exe
708	MsiExec.exe
2264	MsiExec.exe
2264	MsiExec.exe
2264	MsiExec.exe
5028	AliIM.exe
708	MsiExec.exe
888	WhatsApp.exe
888	WhatsApp.exe
2000	WhatsApp.exe
2560	WhatsApp.exe
2000	WhatsApp.exe
2000	WhatsApp.exe
2000	WhatsApp.exe
1464	WhatsApp.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1288-86-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-89-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-88-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-90-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-91-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-102-0x0000000180000000-0x000000018003E000-memory.dmp	upx
behavioral2/memory/1288-141-0x0000000180000000-0x000000018003E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeMeiqiaWinLatest.exemsiexec.exeAliIM.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	MeiqiaWinLatest.exe
File opened (read-only)	\??\M:	MeiqiaWinLatest.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	AliIM.exe
File opened (read-only)	\??\O:	AliIM.exe
File opened (read-only)	\??\K:	AliIM.exe
File opened (read-only)	\??\M:	AliIM.exe
File opened (read-only)	\??\J:	MeiqiaWinLatest.exe
File opened (read-only)	\??\W:	MeiqiaWinLatest.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	MeiqiaWinLatest.exe
File opened (read-only)	\??\Z:	MeiqiaWinLatest.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	AliIM.exe
File opened (read-only)	\??\G:	MeiqiaWinLatest.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	AliIM.exe
File opened (read-only)	\??\R:	AliIM.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	MeiqiaWinLatest.exe
File opened (read-only)	\??\X:	MeiqiaWinLatest.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	AliIM.exe
File opened (read-only)	\??\X:	AliIM.exe
File opened (read-only)	\??\Y:	AliIM.exe
File opened (read-only)	\??\H:	MeiqiaWinLatest.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	AliIM.exe
File opened (read-only)	\??\P:	MeiqiaWinLatest.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	AliIM.exe
File opened (read-only)	\??\T:	AliIM.exe
File opened (read-only)	\??\A:	MeiqiaWinLatest.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	AliIM.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	AliIM.exe
File opened (read-only)	\??\E:	AliIM.exe
File opened (read-only)	\??\H:	AliIM.exe
File opened (read-only)	\??\B:	MeiqiaWinLatest.exe

Drops file in System32 directory 8 IoCs

Processes:

heoft.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	heoft.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	heoft.exe

Drops file in Program Files directory 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Whatsapp\Whatsapp\heoft.exe	msiexec.exe
File created	C:\Program Files\Whatsapp\Whatsapp\WhatsApp.exe	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e589546.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589546.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9621.tmp	msiexec.exe
File created	C:\Windows\Installer\e589548.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2DD15D85-A885-438A-BDE7-BB74C831EBF5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE1E.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

mmc.exenetsh.exemmc.exeheoft.exeexplorer.exemmc.exemsiexec.exesvchost.exenetsh.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	heoft.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	heoft.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft\Settings	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft\task	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	heoft.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState = 240000003428000000000000000000000000000001000000130000000000000062000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	heoft.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft\ring	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft\Sound	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	heoft.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\语音时钟\heoft\Recent File List	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	heoft.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe

Modifies registry class 26 IoCs

Processes:

msiexec.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58D51DD2588AA834DB7EBB478C13BE5F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000_Classes\whatsapp	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\PackageCode = "B4B89C89AEC25114B90D8887C74D1C6E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FE7239DAA600E74789FC2EAE247394F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\PackageName = "Whatsapp.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Whatsapp\\Whatsapp 1.0.0\\install\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000_Classes\whatsapp	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FE7239DAA600E74789FC2EAE247394F\58D51DD2588AA834DB7EBB478C13BE5F	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-488886677-2269338296-1239465872-1000_Classes\whatsapp\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\58D51DD2588AA834DB7EBB478C13BE5F\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\ProductName = "Whatsapp"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\58D51DD2588AA834DB7EBB478C13BE5F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Whatsapp\\Whatsapp 1.0.0\\install\\"	msiexec.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

5024 reg.exe
3216 reg.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exeAliIM.exeWhatsApp.exe

pid process

4156 msiexec.exe
4156 msiexec.exe
5028 AliIM.exe
5028 AliIM.exe
1464 WhatsApp.exe
1464 WhatsApp.exe

pid	process
5024	reg.exe
3216	reg.exe

pid	process
4156	msiexec.exe
4156	msiexec.exe
5028	AliIM.exe
5028	AliIM.exe
1464	WhatsApp.exe
1464	WhatsApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeMeiqiaWinLatest.exe

description	pid	process
Token: SeSecurityPrivilege	4156	msiexec.exe
Token: SeCreateTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeAssignPrimaryTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeLockMemoryPrivilege	4768	MeiqiaWinLatest.exe
Token: SeIncreaseQuotaPrivilege	4768	MeiqiaWinLatest.exe
Token: SeMachineAccountPrivilege	4768	MeiqiaWinLatest.exe
Token: SeTcbPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSecurityPrivilege	4768	MeiqiaWinLatest.exe
Token: SeTakeOwnershipPrivilege	4768	MeiqiaWinLatest.exe
Token: SeLoadDriverPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemProfilePrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemtimePrivilege	4768	MeiqiaWinLatest.exe
Token: SeProfSingleProcessPrivilege	4768	MeiqiaWinLatest.exe
Token: SeIncBasePriorityPrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreatePagefilePrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreatePermanentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeBackupPrivilege	4768	MeiqiaWinLatest.exe
Token: SeRestorePrivilege	4768	MeiqiaWinLatest.exe
Token: SeShutdownPrivilege	4768	MeiqiaWinLatest.exe
Token: SeDebugPrivilege	4768	MeiqiaWinLatest.exe
Token: SeAuditPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemEnvironmentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeChangeNotifyPrivilege	4768	MeiqiaWinLatest.exe
Token: SeRemoteShutdownPrivilege	4768	MeiqiaWinLatest.exe
Token: SeUndockPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSyncAgentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeEnableDelegationPrivilege	4768	MeiqiaWinLatest.exe
Token: SeManageVolumePrivilege	4768	MeiqiaWinLatest.exe
Token: SeImpersonatePrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreateGlobalPrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreateTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeAssignPrimaryTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeLockMemoryPrivilege	4768	MeiqiaWinLatest.exe
Token: SeIncreaseQuotaPrivilege	4768	MeiqiaWinLatest.exe
Token: SeMachineAccountPrivilege	4768	MeiqiaWinLatest.exe
Token: SeTcbPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSecurityPrivilege	4768	MeiqiaWinLatest.exe
Token: SeTakeOwnershipPrivilege	4768	MeiqiaWinLatest.exe
Token: SeLoadDriverPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemProfilePrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemtimePrivilege	4768	MeiqiaWinLatest.exe
Token: SeProfSingleProcessPrivilege	4768	MeiqiaWinLatest.exe
Token: SeIncBasePriorityPrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreatePagefilePrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreatePermanentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeBackupPrivilege	4768	MeiqiaWinLatest.exe
Token: SeRestorePrivilege	4768	MeiqiaWinLatest.exe
Token: SeShutdownPrivilege	4768	MeiqiaWinLatest.exe
Token: SeDebugPrivilege	4768	MeiqiaWinLatest.exe
Token: SeAuditPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSystemEnvironmentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeChangeNotifyPrivilege	4768	MeiqiaWinLatest.exe
Token: SeRemoteShutdownPrivilege	4768	MeiqiaWinLatest.exe
Token: SeUndockPrivilege	4768	MeiqiaWinLatest.exe
Token: SeSyncAgentPrivilege	4768	MeiqiaWinLatest.exe
Token: SeEnableDelegationPrivilege	4768	MeiqiaWinLatest.exe
Token: SeManageVolumePrivilege	4768	MeiqiaWinLatest.exe
Token: SeImpersonatePrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreateGlobalPrivilege	4768	MeiqiaWinLatest.exe
Token: SeCreateTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeAssignPrimaryTokenPrivilege	4768	MeiqiaWinLatest.exe
Token: SeLockMemoryPrivilege	4768	MeiqiaWinLatest.exe
Token: SeIncreaseQuotaPrivilege	4768	MeiqiaWinLatest.exe
Token: SeMachineAccountPrivilege	4768	MeiqiaWinLatest.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

MeiqiaWinLatest.exemsiexec.exeUpdate.exe

pid process

4768 MeiqiaWinLatest.exe
4620 msiexec.exe
4620 msiexec.exe
224 Update.exe
Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

heoft.exemmc.exemmc.exemmc.exe

pid process

1288 heoft.exe
1288 heoft.exe
1288 heoft.exe
1288 heoft.exe
1288 heoft.exe
3400 mmc.exe
3400 mmc.exe
4080 mmc.exe
4080 mmc.exe
5036 mmc.exe
5036 mmc.exe

pid	process
4768	MeiqiaWinLatest.exe
4620	msiexec.exe
4620	msiexec.exe
224	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMeiqiaWinLatest.exemmc.exemmc.exeheoft.execmd.exemmc.exeexplorer.exeAliIM.exeWhatsApp.exeUpdate.exeWhatsApp.exe

description	pid	process	target process
PID 4156 wrote to memory of 1084	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 1084	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 1084	4156	msiexec.exe	MsiExec.exe
PID 4768 wrote to memory of 4620	4768	MeiqiaWinLatest.exe	msiexec.exe
PID 4768 wrote to memory of 4620	4768	MeiqiaWinLatest.exe	msiexec.exe
PID 4768 wrote to memory of 4620	4768	MeiqiaWinLatest.exe	msiexec.exe
PID 4156 wrote to memory of 708	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 708	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 708	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 1568	4156	msiexec.exe	srtasks.exe
PID 4156 wrote to memory of 1568	4156	msiexec.exe	srtasks.exe
PID 4156 wrote to memory of 2264	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 2264	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 2264	4156	msiexec.exe	MsiExec.exe
PID 4156 wrote to memory of 1288	4156	msiexec.exe	heoft.exe
PID 4156 wrote to memory of 1288	4156	msiexec.exe	heoft.exe
PID 3400 wrote to memory of 4968	3400	mmc.exe	netsh.exe
PID 3400 wrote to memory of 4968	3400	mmc.exe	netsh.exe
PID 4080 wrote to memory of 2188	4080	mmc.exe	netsh.exe
PID 4080 wrote to memory of 2188	4080	mmc.exe	netsh.exe
PID 1288 wrote to memory of 1964	1288	heoft.exe	cmd.exe
PID 1288 wrote to memory of 1964	1288	heoft.exe	cmd.exe
PID 1964 wrote to memory of 3476	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 3476	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 4204	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 4204	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 4076	1964	cmd.exe	reg.exe
PID 1964 wrote to memory of 4076	1964	cmd.exe	reg.exe
PID 1288 wrote to memory of 4788	1288	heoft.exe	cmd.exe
PID 1288 wrote to memory of 4788	1288	heoft.exe	cmd.exe
PID 5036 wrote to memory of 3828	5036	mmc.exe	explorer.exe
PID 5036 wrote to memory of 3828	5036	mmc.exe	explorer.exe
PID 4168 wrote to memory of 5028	4168	explorer.exe	AliIM.exe
PID 4168 wrote to memory of 5028	4168	explorer.exe	AliIM.exe
PID 4168 wrote to memory of 5028	4168	explorer.exe	AliIM.exe
PID 5028 wrote to memory of 2240	5028	AliIM.exe	netsh.exe
PID 5028 wrote to memory of 2240	5028	AliIM.exe	netsh.exe
PID 5028 wrote to memory of 2240	5028	AliIM.exe	netsh.exe
PID 5028 wrote to memory of 4572	5028	AliIM.exe	netsh.exe
PID 5028 wrote to memory of 4572	5028	AliIM.exe	netsh.exe
PID 5028 wrote to memory of 4572	5028	AliIM.exe	netsh.exe
PID 656 wrote to memory of 224	656	WhatsApp.exe	Update.exe
PID 656 wrote to memory of 224	656	WhatsApp.exe	Update.exe
PID 656 wrote to memory of 224	656	WhatsApp.exe	Update.exe
PID 224 wrote to memory of 2460	224	Update.exe	Squirrel.exe
PID 224 wrote to memory of 2460	224	Update.exe	Squirrel.exe
PID 224 wrote to memory of 2460	224	Update.exe	Squirrel.exe
PID 224 wrote to memory of 888	224	Update.exe	WhatsApp.exe
PID 224 wrote to memory of 888	224	Update.exe	WhatsApp.exe
PID 888 wrote to memory of 5024	888	WhatsApp.exe	reg.exe
PID 888 wrote to memory of 5024	888	WhatsApp.exe	reg.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe
PID 888 wrote to memory of 2000	888	WhatsApp.exe	WhatsApp.exe

C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest.exe
"C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Whatsapp\Whatsapp 1.0.0\install\Whatsapp.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\MeiqiaWinLatest.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1692813537 "
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0AE345EF4762ED65A33317E8A5C6F985 C
2⤵
- Loads dropped DLL
PID:1084

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A0E98C08CB8BEF51F0442789640ADDC9 C
2⤵
- Loads dropped DLL
PID:708

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1568

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 36102F501E5CBD792B375E1D50B69A73
2⤵
- Loads dropped DLL
PID:2264

C:\Program Files\Whatsapp\Whatsapp\heoft.exe
"C:\Program Files\Whatsapp\Whatsapp\heoft.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\pmTPv.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:3476

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:4204

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
4⤵
- UAC bypass
PID:4076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\BWp2M\PeDK7_z2\n + C:\Users\Public\Pictures\BWp2M\PeDK7_z2\m C:\Users\Public\Pictures\BWp2M\PeDK7_z2\UpdateAssist.dll
3⤵
PID:4788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Modifies data under HKEY_USERS
PID:3032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0
1⤵
PID:996

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:4968

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
2⤵
- Modifies data under HKEY_USERS
PID:2188

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" /root, C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliIM.exe
2⤵
- Modifies data under HKEY_USERS
PID:3828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliIM.exe
"C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliIM.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" dhcp
3⤵
PID:4572

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" interface ip set address \"ÒÔÌ«Íø\" dhcp
3⤵
PID:2240

C:\Program Files\Whatsapp\Whatsapp\WhatsApp.exe
"C:\Program Files\Whatsapp\Whatsapp\WhatsApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\Squirrel.exe
"C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
3⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe
"C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe" --squirrel-install 2.2306.9
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888

C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe
"C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe" --type=gpu-process --field-trial-handle=1304,8787609559026456130,14744536785529526781,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1528 /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000

C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\WhatsApp /prefetch:7 --no-rate-limit --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\WhatsApp\Crashpad --url=https://crashlogs.whatsapp.net/wa_clb_data?access_token=1063127757113399%7C745146ffa34413f9dbb5469f5370b7af --annotation=_productName=WhatsApp --annotation=_version=2.2306.9 --annotation=prod=Electron --annotation=ver=12.2.3 --initial-client-data=0x6ac,0x6b0,0x6b4,0x6a8,0x6b8,0x7ff6a70c2bc0,0x7ff6a70c2bd0,0x7ff6a70c2be0
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD HKCU\Software\Classes\whatsapp /f
4⤵
- Modifies registry class
- Modifies registry key
PID:5024

C:\Users\Admin\AppData\Local\WhatsApp\Update.exe
C:\Users\Admin\AppData\Local\WhatsApp\Update.exe --createShortcut=WhatsApp.exe
4⤵
- Executes dropped EXE
PID:2840

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe DELETE HKCU\Software\Classes\whatsapp /f
4⤵
- Modifies registry class
- Modifies registry key
PID:3216

C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe
"C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1304,8787609559026456130,14744536785529526781,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1944 /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Whatsapp\Whatsapp\WhatsApp.exe

Filesize
153.8MB

MD5
e7030beaf55d524c3bed2c48e8d61441

SHA1
3ae9d253954f449806c56aa6c820ce6943546af2

SHA256
0cdd459b71eaaa96c4e0cfe49ecc3a9425be4531789232397aa510da2304fb2d

SHA512
b6472af45e31df6a4b953532be7ec80d9f3f9703626fe96bae522a46f295350039b412f9c6bab383c20244dfe44770c8b914bf10f6f5847e50c6d57b78c63042

Download Submit
C:\Program Files\Whatsapp\Whatsapp\WhatsApp.exe

Filesize
153.8MB

MD5
e7030beaf55d524c3bed2c48e8d61441

SHA1
3ae9d253954f449806c56aa6c820ce6943546af2

SHA256
0cdd459b71eaaa96c4e0cfe49ecc3a9425be4531789232397aa510da2304fb2d

SHA512
b6472af45e31df6a4b953532be7ec80d9f3f9703626fe96bae522a46f295350039b412f9c6bab383c20244dfe44770c8b914bf10f6f5847e50c6d57b78c63042

Download Submit
C:\Program Files\Whatsapp\Whatsapp\heoft.exe

Filesize
14.3MB

MD5
6c4790535e25c31bd871b7e596548084

SHA1
d2eb54e41ebf56186489239fd7afca6808e218ba

SHA256
6f2957937477c816be367f32265c7732e5cb6175388cb74d63fb4741c5fd4acb

SHA512
b67ae6005ebb223f266b15ababf5185d217552cf0a25b7e756820662eb957ad622eaacef72f7da0c065d313421f4a1bc894fcf5a6d46c6f3fde665f2991dfb3b

Download Submit
C:\Program Files\Whatsapp\Whatsapp\heoft.exe

Filesize
14.3MB

MD5
6c4790535e25c31bd871b7e596548084

SHA1
d2eb54e41ebf56186489239fd7afca6808e218ba

SHA256
6f2957937477c816be367f32265c7732e5cb6175388cb74d63fb4741c5fd4acb

SHA512
b67ae6005ebb223f266b15ababf5185d217552cf0a25b7e756820662eb957ad622eaacef72f7da0c065d313421f4a1bc894fcf5a6d46c6f3fde665f2991dfb3b

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
82B

MD5
84abc65d919d3be2b6be61c19f3fd16f

SHA1
c1eb4f75e11dadf826093017b1e663969bb2f514

SHA256
4f4031d73e12399b2a92ce67ecf464267d86e949c0cc8cf56fd8455ceb2d2a18

SHA512
bd125ae80d9cbb886a5bcaf6e24521d97be6e1acfb09ba17951bcc0d91543ee01258c67965547473c1566566e2f6014ca68add2414475e2bcf00e7dd62611540

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
64254073ba79b3e3685f8ca2647fa462

SHA1
5b261617fc6560c63fa6c6ff47363ded26102be7

SHA256
d655e6a505d71d719e04fd95517bf9b35e6990ba5fd981858cfb10d6379d8daa

SHA512
7f7d041bbfa6ff1f8c3fc3065adf9757114cd9a48e92d05ab687f6383b4d45e055fbc3269041a214d386b7c704df70851783f2535164d2ae8bef7d6734f7f9d8

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
64254073ba79b3e3685f8ca2647fa462

SHA1
5b261617fc6560c63fa6c6ff47363ded26102be7

SHA256
d655e6a505d71d719e04fd95517bf9b35e6990ba5fd981858cfb10d6379d8daa

SHA512
7f7d041bbfa6ff1f8c3fc3065adf9757114cd9a48e92d05ab687f6383b4d45e055fbc3269041a214d386b7c704df70851783f2535164d2ae8bef7d6734f7f9d8

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\WhatsApp-2.2306.9-full.nupkg

Filesize
152.5MB

MD5
aa444ef51427afa6d49c36b6f585dcf1

SHA1
6a7bc69c3965708f94a10a056215c5209395c8f9

SHA256
1e474750f2e7002d463dc2052a9446e727f9b4fda15dfe050e9c0e5143c81eae

SHA512
fa6456d0ad86519fd8f88b459cbaad891f76b435b3e2c9a619946e98f5bd228cd29e41ec71cffdfabada7f9280029efe885ad26c54341d1ad18bee44c0eea34e

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
281KB

MD5
c2b791fcfe8b61dc9aef10c467832048

SHA1
835494a5fd357cf2dcae0c927cdcaae983ba194a

SHA256
866f78e9297e7fbc8211c8143d7b3a77b71896f1508eecee23fce6d542803273

SHA512
c042d9479056223eac684644f284d7fcdc1824b30a3680211afc2cf57a4aefe5212f6b4d91dbfc31b1b05b0cf3ab11aca0b33d5f31aa5bfee77d136a622444ce

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico

Filesize
406KB

MD5
ea3a9a304ce7e7ac102f64aba5fee52d

SHA1
2ec31137e3caa5b0691253471c6bbbdf80191921

SHA256
9cff025f4243e0538ceb7dfa2969efe50b944c301b5240cc8f3d5831c3cfc20a

SHA512
98dba2d8849d7230de8ab3ea9faa30ed8b219f15f91393326b7f97804abbb1cacda34ceb60aff82fb5549a2c0b41531f02ddeb10407fdcbdcc88daace8555b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI52CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDC67.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE1F4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE31D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE31D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE3CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE448.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE60E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\Squirrel.exe

Filesize
2.1MB

MD5
1a5318193134ebe89a237ea966efa032

SHA1
ffa138023354983654c9e28d5741793fd5e29122

SHA256
e0f6edf397165d901eea04c18ca02f6f6de1c039306e14b6afb4db45a8b9473c

SHA512
6b99b82914ddcd4082d2353ae239a6c0ecee88a9803825891d9bf2fbbebbe22b48a1fbef0c9233c4ed98662b04fa2a59309bd6e979c9c42663940cc060f3be45

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe

Filesize
125.4MB

MD5
1500e056a53030f6ce5a684842051fb2

SHA1
5dbe18e72fa2f8e3b34618395a69c68ed700d8f5

SHA256
67804ecf92462c4a58f6d8f276f9f99155baec091406200a34030d2f95c1e381

SHA512
f7926d9df9a316ed0ebef20b700064fd1d7bf42de15fbf137974dbb05d4fb05d91b32b510e2f6b36ce286d908f76a8092ec26915e8ac7ed5d98fa65902d5828c

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe

Filesize
125.4MB

MD5
1500e056a53030f6ce5a684842051fb2

SHA1
5dbe18e72fa2f8e3b34618395a69c68ed700d8f5

SHA256
67804ecf92462c4a58f6d8f276f9f99155baec091406200a34030d2f95c1e381

SHA512
f7926d9df9a316ed0ebef20b700064fd1d7bf42de15fbf137974dbb05d4fb05d91b32b510e2f6b36ce286d908f76a8092ec26915e8ac7ed5d98fa65902d5828c

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe

Filesize
125.4MB

MD5
1500e056a53030f6ce5a684842051fb2

SHA1
5dbe18e72fa2f8e3b34618395a69c68ed700d8f5

SHA256
67804ecf92462c4a58f6d8f276f9f99155baec091406200a34030d2f95c1e381

SHA512
f7926d9df9a316ed0ebef20b700064fd1d7bf42de15fbf137974dbb05d4fb05d91b32b510e2f6b36ce286d908f76a8092ec26915e8ac7ed5d98fa65902d5828c

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe

Filesize
125.4MB

MD5
1500e056a53030f6ce5a684842051fb2

SHA1
5dbe18e72fa2f8e3b34618395a69c68ed700d8f5

SHA256
67804ecf92462c4a58f6d8f276f9f99155baec091406200a34030d2f95c1e381

SHA512
f7926d9df9a316ed0ebef20b700064fd1d7bf42de15fbf137974dbb05d4fb05d91b32b510e2f6b36ce286d908f76a8092ec26915e8ac7ed5d98fa65902d5828c

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\WhatsApp.exe

Filesize
125.4MB

MD5
1500e056a53030f6ce5a684842051fb2

SHA1
5dbe18e72fa2f8e3b34618395a69c68ed700d8f5

SHA256
67804ecf92462c4a58f6d8f276f9f99155baec091406200a34030d2f95c1e381

SHA512
f7926d9df9a316ed0ebef20b700064fd1d7bf42de15fbf137974dbb05d4fb05d91b32b510e2f6b36ce286d908f76a8092ec26915e8ac7ed5d98fa65902d5828c

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\chrome_100_percent.pak

Filesize
123KB

MD5
a59ea69d64bf4f748401dc5a46a65854

SHA1
111c4cc792991faf947a33386a5862e3205b0cff

SHA256
f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9

SHA512
12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\chrome_200_percent.pak

Filesize
183KB

MD5
1985b8fc603db4d83df72cfaeeac7c50

SHA1
5b02363de1c193827062bfa628261b1ec16bd8cf

SHA256
7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b

SHA512
27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\ffmpeg.dll

Filesize
2.7MB

MD5
43688b037b52cebc1a667415e7d045fb

SHA1
b0a1bc8d463e49759bea8d6fc7f298341d86cdac

SHA256
1fc7741278dbe4c2893a7c81f3c67114e172537333729d8989c1f3f33d7eaeb9

SHA512
39e0eb8aec5e38a3eba396f5a2a40982998c9a3f64bddacb1184b49b48ed3ff5e5a9aadfa552197bde083024b9dc8c416448561590f0f3819f697d4c90e917ef

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\icudtl.dat

Filesize
9.9MB

MD5
70499b58dc18e7ee1d7452a1d7a8bc6e

SHA1
41c5382f08c6a88670ce73a20c0dcdb3822f19e9

SHA256
02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0

SHA512
a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\locales\en-US.pak

Filesize
85KB

MD5
6bbeeb72daebc3b0cbd9c39e820c87a9

SHA1
bd9ebec2d3fc03a2b27f128cf2660b33a3344f43

SHA256
ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b

SHA512
66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\resources.pak

Filesize
4.9MB

MD5
5507bc28022b806ea7a3c3bc65a1c256

SHA1
9f8d3a56fef7374c46cd3557f73855d585692b54

SHA256
367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df

SHA512
ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\resources\app.asar

Filesize
250.6MB

MD5
04f163e3c8cb11c0f148378333f459c8

SHA1
f386d372404e330477a92be1d4b9301dc669110e

SHA256
e32363692ad6575dd8f536fbe177ae94d19da4b03ad5c61ef7aa4394458b3342

SHA512
4a595838f2ebd65efe843dc569099df92d5727583d75587b8c72404117b090808a37f883f5243dd4badada44cf339772cb0d292cff3d03c07251a19e263143b7

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node

Filesize
632KB

MD5
bcfacc01da45e22cbb48c6f0d55663e4

SHA1
db6967a729b79e7217daf3b5c75fcf2afbf0fd80

SHA256
3f53b660e64cd75aae8297ff719f9d6d0f3a56b876c2f5657664b6a825577083

SHA512
7609a1d5eecff5b02046d83a24be930505e004bab701aa9ad9fbb374cb8b8391602c2b1caf20f00efe089629804338806e5e6cc7dd3cd5064f0754b6e47ed31a

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\squirrel.exe

Filesize
2.1MB

MD5
1a5318193134ebe89a237ea966efa032

SHA1
ffa138023354983654c9e28d5741793fd5e29122

SHA256
e0f6edf397165d901eea04c18ca02f6f6de1c039306e14b6afb4db45a8b9473c

SHA512
6b99b82914ddcd4082d2353ae239a6c0ecee88a9803825891d9bf2fbbebbe22b48a1fbef0c9233c4ed98662b04fa2a59309bd6e979c9c42663940cc060f3be45

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\v8_context_snapshot.bin

Filesize
160KB

MD5
b64c1fc7d75234994012c86dc5af10a6

SHA1
d0d562b5735d28381d59d0d86078ff6b493a678e

SHA256
31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790

SHA512
6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\packages\WhatsApp-2.2306.9-full.nupkg

Filesize
152.5MB

MD5
aa444ef51427afa6d49c36b6f585dcf1

SHA1
6a7bc69c3965708f94a10a056215c5209395c8f9

SHA256
1e474750f2e7002d463dc2052a9446e727f9b4fda15dfe050e9c0e5143c81eae

SHA512
fa6456d0ad86519fd8f88b459cbaad891f76b435b3e2c9a619946e98f5bd228cd29e41ec71cffdfabada7f9280029efe885ad26c54341d1ad18bee44c0eea34e

Download Submit
C:\Users\Admin\AppData\Local\WhatsApp\update.exe

Filesize
1.8MB

MD5
64254073ba79b3e3685f8ca2647fa462

SHA1
5b261617fc6560c63fa6c6ff47363ded26102be7

SHA256
d655e6a505d71d719e04fd95517bf9b35e6990ba5fd981858cfb10d6379d8daa

SHA512
7f7d041bbfa6ff1f8c3fc3065adf9757114cd9a48e92d05ab687f6383b4d45e055fbc3269041a214d386b7c704df70851783f2535164d2ae8bef7d6734f7f9d8

Download Submit
C:\Users\Admin\AppData\Roaming\WhatsApp\Crashpad\settings.dat

Filesize
40B

MD5
866dca7d0f708d2331071365a65eabce

SHA1
faad4281aa618e656edf53cd9abc0ad37b614dcd

SHA256
1088b0cfd315c07eb1413bcc064018cd9d6b4883554da0034c811e10712aa89a

SHA512
717970e55e751fad9238893cdf36d41f7b8da5c1fccc4656aaa9050def02c8620df459860082e77aeaf5509267fef872de74e54bc08e769cc84c16c43a0f1026

Download Submit
C:\Users\Admin\AppData\Roaming\Whatsapp\Whatsapp 1.0.0\install\Whatsapp.msi

Filesize
1.5MB

MD5
3b8f79c355fe878b6030ceeb44f68dda

SHA1
bdc060851c1b3510075525bd8927d6b965e4bfc4

SHA256
d5f7e6194e76e5ac56e909e456768d804e0749df0df66efbc5880cae466bc460

SHA512
e2bcbecb62a5c46968964a83846f4a64b66dbd43eef226a136d90ae40dd5803d83807f8d1165399a282132c1cc5618e261f9a514f7f5b2745c529190b7d2e189

Download Submit
C:\Users\Admin\AppData\Roaming\Whatsapp\Whatsapp 1.0.0\install\Whatsapp.msi

Filesize
1.5MB

MD5
3b8f79c355fe878b6030ceeb44f68dda

SHA1
bdc060851c1b3510075525bd8927d6b965e4bfc4

SHA256
d5f7e6194e76e5ac56e909e456768d804e0749df0df66efbc5880cae466bc460

SHA512
e2bcbecb62a5c46968964a83846f4a64b66dbd43eef226a136d90ae40dd5803d83807f8d1165399a282132c1cc5618e261f9a514f7f5b2745c529190b7d2e189

Download Submit
C:\Users\Admin\AppData\Roaming\Whatsapp\Whatsapp 1.0.0\install\Whatsapp1.cab

Filesize
158.1MB

MD5
fc6d590ae11eb4d9f0a6ce27a3dcaed9

SHA1
3db35cbd91c3480bfa8e95cf79aa655675621d81

SHA256
2eea0445590da7956bdcfddb27b6b93430e171d9086ac40f9e10731f5bc65a62

SHA512
6603d296712d7428fc7bfcae36f8d131043b4f21fa7382ba5c2adb10ab453d713b736828b67b9afa7abb81e6124b3bc163df03db98e8840c4dceb0ebd7e7c62d

Download Submit
C:\Users\Admin\AppData\Roaming\pmTPv.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliIM.exe

Filesize
473KB

MD5
ed17abee766074018926ff48e0ce7a3d

SHA1
d6d3172176302db9ee6225ea06dc1667a814327b

SHA256
a8325bd88171952dfb45b16d8bf541e4fbe5d0e546c4e6f6d8aca32b96756dc8

SHA512
7dba4925e7aa66b172c76e294938385db09edaf652b751ca3464b03b6203387c07c13c93eafaa9707ec8ad03cc586b1d67abbc731ff6792d422f49a18c30ca86

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliIM.exe

Filesize
473KB

MD5
ed17abee766074018926ff48e0ce7a3d

SHA1
d6d3172176302db9ee6225ea06dc1667a814327b

SHA256
a8325bd88171952dfb45b16d8bf541e4fbe5d0e546c4e6f6d8aca32b96756dc8

SHA512
7dba4925e7aa66b172c76e294938385db09edaf652b751ca3464b03b6203387c07c13c93eafaa9707ec8ad03cc586b1d67abbc731ff6792d422f49a18c30ca86

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\AliwangwangFramework.dll

Filesize
215KB

MD5
0ba0713397a453abccfdd0542a8a8c1d

SHA1
38825f7a4f8997998620d695beb80f7aa9748e6a

SHA256
6e0aaf4d72409c28d8ae7bd0b669615cd5bc7d1b3631e024dc04db57f02b16b3

SHA512
f550cdd6f9dfb4763c8677d3ba807137c7ff7865484817321d5c28d8a1b8177fb3d2016662c27e04cb27df935bb963c51e374888dd8046a8f19bdebd9421a5a8

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\UpdateAssist.dll

Filesize
200KB

MD5
61d49ae47f7fc07f79af64c95169f69e

SHA1
e46f038cfea8de5d75bf9f24c44079b16769457d

SHA256
05afde58840d8e5a98e479c404a2d508b3a5c85bd6f6fc1f4ecfcf0bc38ed10e

SHA512
74d45e6517d0513d46f7e6453154ef832004998d4da2e31c81cbe64acc3a94d24599f065d60dfbe3ca562f2bb4c3f89c5a5acb9de39aa921d26bdf4745505f63

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\ZP.log

Filesize
159KB

MD5
8deb060ded3af0b733f967caae99d9b3

SHA1
4a33d4e1fc45f325191f82c3e5a7decc99f21254

SHA256
b12a8ea89bd5582c54dca77c663c1a4f6f0d68d1d41ecd2b56fff7520109832d

SHA512
ae7c02cb1cab1b4a0be18ea72034cf9ed8426fb31d51114ca454eef90205aacd60770b68f18d27305c79dcf75755d4bad80affa5c644665cae1802a2ca6ffb0d

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\m

Filesize
100KB

MD5
41018de291eabc6864c0df467b0b3f79

SHA1
0f4777c5e381fff0cce6036ac7aac12984518e18

SHA256
c654b24360b208b58c66dec156dd2698e03b09a44ea1d6b8eef875275c5ab5f4

SHA512
2a661c5e86a65c4ec5310e5e7f7f6f43af7efe93ead598cf6b5b4afe9b24429b86268746ca0396f02818d4d86fcae27088bfe56614779b4fe626627ea4747ae5

Download Submit
C:\Users\Public\Pictures\BWp2M\PeDK7_z2\n

Filesize
100KB

MD5
bf3be0df5d9f5aa446f73bcf5bdc7d1d

SHA1
1385c180fbae3056a648c921acf0fc7ed075d998

SHA256
1196416efafd445f2eafde81c8f783573613d0594997361016a2ae1452ff490c

SHA512
8c0e33a4eebb3fd8dbd179caa987ff86b978450eb07fdd9aaec754f949a3667e4c372843fb0e70b32312ebe28f36f43e3fe4ea82a9994f3ce19316a9c54e4acb

Download Submit
C:\Windows\Installer\MSI9621.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI97C7.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI98B3.tmp

Filesize
632KB

MD5
db4e30e47be69408ccdebffc517764c1

SHA1
9ab0db45e9c84670fe8a3181bf38511e8776815f

SHA256
3558203b78ee8ea16f1151cc7034ad9fd4850fce0f948aed4231b870ae51904a

SHA512
a32ed4fec7e381605e8d0fc463bf65140d5dc7a499aced785b4ef644a5bae1a4dc693ba33be8be46b07ccd049fceef95136a8fd852219ff18293c19da5fed129

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
a6517dc6baab7db4e3af672aaad9f0de

SHA1
793a3a9a8276c8bfe19d97f088318f74504f6ae9

SHA256
f3aee6da8421dcbb6c2ed3fb2656562e2edec143430f92de7ebfd1bc2519b510

SHA512
b5409acd01e996d88780de60dfc0ba7b0b3df98b446d2f8d1a7074421c126be7f31ef1712fb1284029217d32f9be57f8d2a5f052185859798f64fcf24c40cb52

Download Submit
\??\Volume{2cc02b81-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a5dbed43-331c-4e34-918f-9116a143702f}_OnDiskSnapshotProp

Filesize
5KB

MD5
d9085d8d96d78dee0374c02ba8f890fe

SHA1
5674f2d02c89feeb4697ff2bbc8f51e7f5af1791

SHA256
7d589341fc76ad6bcdea8325a8c2b4ff07d0ca90837afe52866e2d49b0544b4c

SHA512
dacce513c735a1819a84904f8cdfe423098f16c1a0b77366303e3825d915913f8f6e9f94b58a7623dfbe896c68ebf5d21638bcde598c392bfdaf30784fc9f78c

Download Submit
\Users\Admin\AppData\Local\Temp\MSI52CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIDC67.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE1F4.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE31D.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE3CA.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE448.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE60E.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\ffmpeg.dll

Filesize
2.7MB

MD5
43688b037b52cebc1a667415e7d045fb

SHA1
b0a1bc8d463e49759bea8d6fc7f298341d86cdac

SHA256
1fc7741278dbe4c2893a7c81f3c67114e172537333729d8989c1f3f33d7eaeb9

SHA512
39e0eb8aec5e38a3eba396f5a2a40982998c9a3f64bddacb1184b49b48ed3ff5e5a9aadfa552197bde083024b9dc8c416448561590f0f3819f697d4c90e917ef

Download Submit
\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\ffmpeg.dll

Filesize
2.7MB

MD5
43688b037b52cebc1a667415e7d045fb

SHA1
b0a1bc8d463e49759bea8d6fc7f298341d86cdac

SHA256
1fc7741278dbe4c2893a7c81f3c67114e172537333729d8989c1f3f33d7eaeb9

SHA512
39e0eb8aec5e38a3eba396f5a2a40982998c9a3f64bddacb1184b49b48ed3ff5e5a9aadfa552197bde083024b9dc8c416448561590f0f3819f697d4c90e917ef

Download Submit
\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\ffmpeg.dll

Filesize
2.7MB

MD5
43688b037b52cebc1a667415e7d045fb

SHA1
b0a1bc8d463e49759bea8d6fc7f298341d86cdac

SHA256
1fc7741278dbe4c2893a7c81f3c67114e172537333729d8989c1f3f33d7eaeb9

SHA512
39e0eb8aec5e38a3eba396f5a2a40982998c9a3f64bddacb1184b49b48ed3ff5e5a9aadfa552197bde083024b9dc8c416448561590f0f3819f697d4c90e917ef

Download Submit
\Users\Admin\AppData\Local\WhatsApp\app-2.2306.9\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node

Filesize
632KB

MD5
bcfacc01da45e22cbb48c6f0d55663e4

SHA1
db6967a729b79e7217daf3b5c75fcf2afbf0fd80

SHA256
3f53b660e64cd75aae8297ff719f9d6d0f3a56b876c2f5657664b6a825577083

SHA512
7609a1d5eecff5b02046d83a24be930505e004bab701aa9ad9fbb374cb8b8391602c2b1caf20f00efe089629804338806e5e6cc7dd3cd5064f0754b6e47ed31a

Download Submit
\Users\Public\Pictures\BWp2M\PeDK7_z2\UpdateAssist.dll

Filesize
200KB

MD5
61d49ae47f7fc07f79af64c95169f69e

SHA1
e46f038cfea8de5d75bf9f24c44079b16769457d

SHA256
05afde58840d8e5a98e479c404a2d508b3a5c85bd6f6fc1f4ecfcf0bc38ed10e

SHA512
74d45e6517d0513d46f7e6453154ef832004998d4da2e31c81cbe64acc3a94d24599f065d60dfbe3ca562f2bb4c3f89c5a5acb9de39aa921d26bdf4745505f63

Download Submit
\Windows\Installer\MSI9621.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Windows\Installer\MSI97C7.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
\Windows\Installer\MSI98B3.tmp

Filesize
632KB

MD5
db4e30e47be69408ccdebffc517764c1

SHA1
9ab0db45e9c84670fe8a3181bf38511e8776815f

SHA256
3558203b78ee8ea16f1151cc7034ad9fd4850fce0f948aed4231b870ae51904a

SHA512
a32ed4fec7e381605e8d0fc463bf65140d5dc7a499aced785b4ef644a5bae1a4dc693ba33be8be46b07ccd049fceef95136a8fd852219ff18293c19da5fed129

Download Submit
memory/224-272-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/224-271-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/224-171-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/224-242-0x000000000A280000-0x000000000A2B8000-memory.dmp

Filesize
224KB

Download
memory/224-170-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/224-169-0x0000000000780000-0x0000000000944000-memory.dmp

Filesize
1.8MB

Download
memory/1288-141-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-91-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-90-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-102-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-89-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-86-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/1288-88-0x0000000180000000-0x000000018003E000-memory.dmp

Filesize
248KB

Download
memory/2000-311-0x00007FFCCE3F0000-0x00007FFCCE3F1000-memory.dmp

Filesize
4KB

Download
memory/2460-354-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-288-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/2460-285-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-283-0x0000000000720000-0x000000000094A000-memory.dmp

Filesize
2.2MB

Download
memory/2460-355-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/2840-333-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-335-0x0000000004A80000-0x0000000004AA0000-memory.dmp

Filesize
128KB

Download
memory/2840-334-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2840-344-0x0000000071D60000-0x000000007244E000-memory.dmp

Filesize
6.9MB

Download
memory/5028-151-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-132-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-133-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-134-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-147-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-148-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-149-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-150-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download
memory/5028-154-0x0000000000FB0000-0x000000000100E000-memory.dmp

Filesize
376KB

Download