Edit tour

Windows Analysis Report
https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb

Overview

General Information

Sample URL:	https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb
Analysis ID:	846994

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 6860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 8064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Source: unknown

DNS traffic detected: queries for: chat.whatsapp.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.8.45
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.32.24
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.32.24
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.8.45
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.196

Source: classification engine

Classification label: clean0.win@31/106@7/123

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5848 --field-trial-handle=1852,i,5215479780001253398,11705668152728333783,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\Feedback

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mmx-ds.cdn.whatsapp.net	157.240.20.52	true	false	high
accounts.google.com	172.217.16.205	true	false	high
www.google.com	142.250.185.100	true	false	high
clients.l.google.com	142.250.185.110	true	false	high
clients2.google.com	unknown	unknown	false	high
web.whatsapp.com	unknown	unknown	false	high
chat.whatsapp.com	unknown	unknown	false	high
static.whatsapp.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb	false		high
https://web.whatsapp.com/	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	clients.l.google.com	United States	15169	GOOGLEUS	false
52.109.32.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.8.45	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
192.229.221.95	unknown	United States	15133	EDGECASTUS	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
157.240.20.52	mmx-ds.cdn.whatsapp.net	United States	32934	FACEBOOKUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	846994
Start date and time:	2023-04-14 18:55:28 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	1
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@31/106@7/123

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, usocoreworker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 34.104.35.123
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, login.live.com, slscr.update.microsoft.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Created / dropped Files

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

File Type:	data
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.054001950375981
Encrypted:	false
SSDEEP:
MD5:	E17D99171754DAD5CC3B3DCCBBCAF28E
SHA1:	EEB357F35819D45BCCAEAF4E1F21A2E03EAE240C
SHA-256:	F34F13F9566BF0319AE48035A24D5EF2A6925734F658CC6914941EF3A79ED329
SHA-512:	6F0730EE5BB7DCED3ED78A8F3A15963A2C68A0BEF61A0BCB65BBBD69B6A0BFF24FADB01B11790D78351B379441FA419A4D7217D1A7B376619382FE249509F1A7
Malicious:	false
Reputation:	low
Preview:	.6...AAAAAAA...AAAAA...A.A.A/ALAAAAAAAAAAAbA5AtA.!.AGA.A.bbA.A`A.].A%A.A...A AHA...AVA.A.n.AKA.A6d.A.A.A6.A~AEA...6.A.A..Ab.A...A...A...An.LA..bA...A..bA..#A..bA5..A...6#.qA.^tA..&A.5.6..A..bA..A...6`.~A.G.6N..A..bA2..A...A6#.A.-.A.#.A...A.#cA...6#.A.bA..A...An..A...A..A..bA..A. bA..A.tbA.SAA.AbA.S.A.6.AF..A.L.A`..A...AN.A...A..(A.}.A...A.1.A...A..A...A...AV..A..AQ.yA._.AE.MA...A\|.A...AU..A...6...A...6...A.?.6...A.H.A..A.9bAK.XA...A...A...A..DA..A...A.%bAZ.A.;b.q..A.#b...7A...Aw..A68.AAA.AtA.6...........................................................

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10273)
Category:	downloaded
Size (bytes):	18894
Entropy (8bit):	5.348459631457549
Encrypted:	false
SSDEEP:
MD5:	E579B33A8CA48353936B23296CC15EC7
SHA1:	0D186E099947223F0DEA1D6714FE71F7698EB3F6
SHA-256:	BABCC6AAEB5625EC59B229C8B909AB3B933824E63540F68C3C9B831FBAFE76B4
SHA-512:	4A59B962B646E99C9C85AC25FACE3E078EAAFD8DC123AFB650DAB10D17BF28F243026A4EF0CF2C76C770CF76AA78927902A453C362944285941E25A3BB7CD48D
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/vendors~main.ea7976d03b8f99c02329.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[9821],{49090:e=>{function t(e,t){e.onload=function(){this.onerror=this.onload=null,t(null,e)},e.onerror=function(){this.onerror=this.onload=null,t(new Error("Failed to load "+this.src),e)}}function o(e,t){e.onreadystatechange=function(){"complete"!=this.readyState&&"loaded"!=this.readyState\|\|(this.onreadystatechange=null,t(null,e))}}e.exports=function(e,n,r){var a=document.head\|\|document.getElementsByTagName("head")[0],i=document.createElement("script");"function"==typeof n&&(r=n,n={}),n=n\|\|{},r=r\|\|function(){},i.type=n.type\|\|"text/javascript",i.charset=n.charset\|\|"utf8",i.async=!("async"in n)\|\|!!n.async,i.src=e,n.attrs&&function(e,t){for(var o in t)e.setAttribute(o,t[o])}(i,n.attrs),n.text&&(i.text=""+n.text),("onload"in i?t:o)(i,r),i.onload\|\|t(i,r),a.appendChild(i)}},829750:e=>{e.exports=function(e,t,o){return e==e&&(void 0!==o&&(e=e<=o?e

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6603)
Category:	downloaded
Size (bytes):	6683
Entropy (8bit):	5.033107919956822
Encrypted:	false
SSDEEP:
MD5:	AA7F8D7858530A957F230A6FF511EC8F
SHA1:	57FD50D7FA536341954B835FA1835A7DB339F085
SHA-256:	D1AA6C4AB2DABA84E9082980E75F0BAB05B5C126FE50EC98844A579585C5BA0F
SHA-512:	1247F3598E7BA716293AC290C8BFA80B991551E243F3DF34883778ECC7160DD8D7B383C533D96E1F4B7F5A6291CD499AD7A34093648560466BBB4B5E57068633
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yI/l/0,cross/C2fHuK6eV5E.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.rich-text a.fragment{border:0;box-sizing:border-box;display:block;font-size:0;height:0;line-height:0;outline:none;pointer-events:none;position:relative;text-decoration:none}@media (min-width: 1096px){.rich-text a.fragment{padding-top:121px;margin-top:-121px}}@media (min-width: 768px) and (max-width: 1095px){.rich-text a.fragment{padding-top:104px;margin-top:-104px}}@media (max-width: 767px){.rich-text a.fragment{padding-top:91px;margin-top:-91px}}.rich-text{font-size:14px;line-height:1.45}@media (min-width: 768px){.rich-text{font-size:16px;line-height:1.625;color:#5e5e5e}.rich-text.rich-text--large{font-size:18px;line-height:1.625}}@media (max-width: 767px){.rich-text{font-size:15px;line-height:1.5;color:#282828}}@media (min-width: 768px){.rich-text p,.rich-text ul,.rich-text ol{margin-bottom:31px}}@media (max-width: 767px){.rich-text p,.rich-text ul,.rich-text ol{margin-bottom:21px}}.rich-text sup{font-size:12px;vertical-align:top;display:inline;opacity:.8}.rich-text ol{list-style-ty

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29500)
Category:	downloaded
Size (bytes):	61616
Entropy (8bit):	5.339013643831132
Encrypted:	false
SSDEEP:
MD5:	B8221F08C19795D6AE8F6666B00B4581
SHA1:	E4E4C5341AFAFE6B4B48D3A589A6D65FF5F34239
SHA-256:	AAC95C3D119E48D5597DEA6CA6BF0CE01E47DD3182617CA270AAA1CE9921C537
SHA-512:	B545CBA9D069CEAB3F4FF461D0F0EF161B431B041F7CAEBB72F77E51C187D11CA47DB93579D70A00C8BCAC6B9B308BC7FFA34FE7CD7E8251735C26E14580248F
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3i7M54/yy/l/en_US/5lny7st5Ipv.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("getOpacityStyleName",[],(function(a,b,c,d,e,f){var g=!1,h=null;function a(){if(!g){if(document.body&&"opacity"in document.body.style)h="opacity";else{var a=document.createElement("div");a.style.filter="alpha(opacity=100)";a.style.filter&&(h="filter")}g=!0}return h}f["default"]=a}),66);.__d("StyleCore",["invariant","camelize","containsNode","err","getOpacityStyleName","getStyleProperty","hyphenate"],(function(a,b,c,d,e,f,g,h){function i(a,b){a=o.get(a,b);return a==="auto"\|\|a==="scroll"}var j=new RegExp("\\s([^\\s:]+)\\s:\\s([^;('\"](?:(?:\$[^)]\$\|\"[^\"]\"\|'[^']')[^;(?:'\"]))(?:;\|$)","g");function k(a){var b={};a.replace(j,function(a,c,d){b[c]=d;return d});return b}function l(a){var b="";for(var c in a)a[c]&&(b+=c+":"+a[c]+";");return b}function m(a){return a!==""?"alpha(opacity="+a100+")":""}function n(a,b,d){switch(c("hyphenate")(b)){case"font-weight":case"line-height":case"opacity":case"z-index":case"animation-iteration-count":case"-webkit-animatio

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18631)
Category:	downloaded
Size (bytes):	311488
Entropy (8bit):	5.416589685672816
Encrypted:	false
SSDEEP:
MD5:	64C7E022366CD659CB491389A6584A9F
SHA1:	BDE09E7EA9810D0BD24B321DD3F86B7EBE9E7647
SHA-256:	AD7D15812EAA6A06C1BA50FD4E12534AFA72EF234E6263DDF5D633FE1EA7A9D0
SHA-512:	3E6A9FE57FB89DDE212DED8D5C893A1489F24E60242F2BC711EBA809C71F5E90E8181602DD8C3CF088F9AF327D34DD2F0373D2C0D4378A56868C1331F5E42C90
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/y6/r/PTAMAF8Hi8v.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5972
Entropy (8bit):	7.910397098451488
Encrypted:	false
SSDEEP:
MD5:	E336B9F3F460E6C20E4D5E71CDFAD26E
SHA1:	E9F3B05843D83BD683CFB6255B2C17B34B856442
SHA-256:	A56E09B35771741E861D9AC7432BC80DB83DA2620CCD9839A3F1BC2657BBEBFF
SHA-512:	5CD618BE71C0A58AA71B9C587AB9C7D9AE77B59BCAE9888E22D148FEA4EC457D9E0C2BCC4395F442FF614F8C3D105F84E847E2CEB17E20E7B23F9317A1752833
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/whatsapp_pwa_icon_192.png
Preview:	.PNG........IHDR.............R.l.....pHYs.................sRGB.........gAMA......a.....IDATx..M..G...$V.~....a7..I.%..l.qln g#....c.D,....._...rb..U........./.....P.....x.8....wW.{.3.U....T.Oj..w.y..\|T.S#....W'.C+u.%........."/.......kddd.......)CoSb...5A.......rZ..K.#..2.........@.]q.F.("..$...i.0..~.x.....1..#...~....#....`A\....,.Th.....t.5'.cMM..'.a.mJF.Y.{.7....0.D.....q...F$.g..:.....4.o..I...).%!.3>..^.@.~....`.6.B.J...O.....!....B.S9..D... ..#~0...uH..yb.[..r.K....;...p.e.%f ...x...w.....g...X.J...F..6%3.......3.%F.....p.M..t.I.....c...$...1.Qv6....s.)..`..h..y.s.L.$Nz...$.."q.r1$r.......S...'Z.:.b....V.B..#.L_...38......n(o6.L..wa.N....~c....V...o<..,..r.a..\|...f.d...V3.x...1.d7............2g0.@...)i..R.../.C..`f.'....L...?..F..P%!P*....@8TYb\.....@N....]"-......@y...Hi.@.o.u.@Q"J<A).&...a.z..-Jl..J..\.....l.PY.H..@r.wi..4..s.V. ....a.7P..+C.....@EDd1).....E..\..=Z..2-.p!y....Mn.m.q..(...%.v.,`.....=0.s./...?/......i.....a..S4~...q.

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65461)
Category:	downloaded
Size (bytes):	246790
Entropy (8bit):	4.867634106838732
Encrypted:	false
SSDEEP:
MD5:	DDB8943FE87D0095B6976A590B05D258
SHA1:	66D6A921E11A40E60485E967F21F00085FB1DC58
SHA-256:	8B9EA22559CA2F6BAA3311C4EE98A12F991ABF734EA1FE2418D731B600668BF9
SHA-512:	4C14726E4FC1EF477136F31F5E8836B8E115EF51660D583BDCE49E7BDA43BD18464CF51A819CB3C32EA4C9AB303AD32CD84EB4FBF6F02F687EE646F6BDCA1183
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/locales/ms~main.a35082d2aa29ef882ba9.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[353],{761605:(a,n,e)=>{"use strict";e.r(n),e.d(n,{default:()=>i});const i={ms_MY:{"1lXNBq":"Hei! Saya menggunakan WhatsApp.",t3dsg:"Mikrofon","3rNIUz":"Peranti Audio","49GA08":"Kamera","4B0NPs":"Gunakan {deviceName} sebagai {deviceType} anda untuk Panggilan WhatsApp","1K6Ao7":"~{spacing}{notifyName}","1vt3xl":"Mungkin {notifyName}","3l6ovX":"Pinkan Sembang","3CChip":"Cari",eUGKg:"Cari Sembang","4pF7QC":"Tutup Sembang",YQPbc:"Tingkatkan Kelajuan Mesej Suara Terpilih",uHTZ8:"Kurangkan Kelajuan Mesej Suara Terpilih","2sDpHl":"Panel Emoji","28HQaF":"Panel Gif","4y6bgb":"Panel Pelekat","14n1j0":"Carian Lanjutan","1QtrdH":"Hiasan latar sembang","3Xtg52":"Minta Info Akaun",aXthJ:"Pemberitahuan","1m2nwe":"Pengesahan Dua Langkah",Xld4T:"Muat turun automatik media","2ucAX":"Keselamatan","4tjoQy":"Privasi","2f7GS5":"Tetapan desktop","2IULqT":"Bantuan"

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65475)
Category:	downloaded
Size (bytes):	3141183
Entropy (8bit):	5.6460368068701285
Encrypted:	false
SSDEEP:
MD5:	899C91AFEEF38C00F73D3BA7A6B4046A
SHA1:	A3E4838571618D8846B1233D14600DECC0417181
SHA-256:	8DB53753157819488A03F9F92BBD0E9B50590133DD708A1D1795FB7427F0A977
SHA-512:	78BBA34B51AF250907AB7BF7AB071352B43FA05C55D8BFD22DB64806ED31135CED4DEDD1A2BD47FF6B6EE1E74FFDA2A17B9CD8550595984291719DE239726CB8
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main.e8e470578629536b1b24.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[179],{292744:e=>{"use strict";e.exports=JSON.parse('{"v":"5.7.4","fr":29.9900054931641,"ip":0,"op":333.000060994453,"w":190,"h":120,"nm":"Comp 1","ddd":0,"assets":[],"layers":[{"ddd":0,"ind":1,"ty":4,"nm":"Graphic Outlines 3","sr":1,"ks":{"o":{"a":0,"k":100},"r":{"a":0,"k":0},"p":{"a":0,"k":[95,60,0]},"a":{"a":0,"k":[93,58,0]},"s":{"a":0,"k":[100,100,100]}},"ao":0,"hasMask":true,"masksProperties":[{"inv":false,"mode":"a","pt":{"a":0,"k":{"i":[[0,0],[0,0],[-19.412,-1.227],[-3.848,-0.447],[-24.798,4.416],[-6.722,4.072],[0,0],[0,0]],"o":[[0,0],[0,0],[10.548,0.667],[4.615,0.537],[15.816,-2.817],[3.841,-2.326],[0,0],[0,0]],"v":[[17.037,36.952],[13.568,101.171],[51.662,105.227],[76.735,112.498],[130.934,106.817],[177.896,98.49],[171.776,61.758],[166.995,46.289]],"c":true}},"o":{"a":0,"k":100},"x":{"a":0,"k":0},"nm":"Mask 1"}],"shapes":[{"ty":"gr"

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6000)
Category:	downloaded
Size (bytes):	10259
Entropy (8bit):	5.551098578033268
Encrypted:	false
SSDEEP:
MD5:	7DE94A5115F3966F0A12CE9CDC3F2532
SHA1:	80D3D25355DD1BD7059A04D195CA83151BF4BDAD
SHA-256:	C29393AC30E67908A28297439AA800F465D9FEA4DEDD5C2C42F11931FB62D9A7
SHA-512:	3A242D1B52CC673EA7F76E5BEF066E4E9A16D05856A5D0F787AF64BDBBB9DF6A4296E1EEB217CEA5F354B703C9EF00138321C1FD2F75ECD5568F0A23C4C6C626
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/accept?code=H193ChGfll800H9BkVkEDb
Preview:	<!DOCTYPE html><html class="no-js" dir="ltr" loc="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><title>WhatsApp Web</title><meta name="viewport" content="width=device-width"><meta name="google" content="notranslate"><meta name="format-detection" content="telephone=no"><meta name="description" content="Quickly send and receive WhatsApp messages right from your computer."><meta name="og:description" content="Quickly send and receive WhatsApp messages right from your computer."><meta name="og:url" content="https://web.whatsapp.com/"><meta name="og:title" content="WhatsApp Web"><meta name="og:image" content="https://static.facebook.com/images/whatsapp/www/whatsapp-promo.png"><link id="favicon" rel="shortcut icon" href="/img/favicon/1x/favicon.png" type="image/png"><link rel="apple-touch-icon" sizes="194x194" href="/apple-touch-icon.png" type="image/png"><meta name="theme-color" content="#111b21" media="(prefers-color-scheme: dark)"><meta name

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32232)
Category:	downloaded
Size (bytes):	240789
Entropy (8bit):	5.8921385468105045
Encrypted:	false
SSDEEP:
MD5:	C4475DB52BCF54601DBCF1B901F2034C
SHA1:	43B4A2440442C0996F7D06BDC8358C143E1EA4B6
SHA-256:	324E8F4916BA2A4094ECB8E396D8997F5D510C496EFE3C8A20D28DE524E8BFED
SHA-512:	5FE7DC05E8EF9D1253E1348BB00D54507C11025B7A33E0FD7CF2D21585B76CDDF8554C7C19EC705EE025B8AB74C3D775C22D48C0ED5263C15667FCCE40E13704
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main~.2fcb1ca970a094ed9d6f.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[1280],{11775:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.broadcastListEnabled=function(){return!1}},797163:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){if(e===i)return;i=e;const[t,l,a]=e===r.EMOJI_TYPE.APPLE?[n(28193).Z,n(23424).Z,n(639154).default]:[n(568412).Z,n(846355).Z,n(738779).Z];o.EmojiUtil.configure({emojiType:e,orderedEmojis:t,legacyToEmoji:l,categorizedEmojis:a})};var o=n(70354),r=n(708733);let i},639154:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;t.default={SMILEYS_PEOPLE:["..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..",".

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	643
Entropy (8bit):	7.1594140456292195
Encrypted:	false
SSDEEP:
MD5:	4A25BE0C95D280005EA78D83FB18B922
SHA1:	C70CD9F970418ACB075D497D45FD7001B0D0FEDD
SHA-256:	79ADDAFADD1DCEE91EC75407A2142D016B25028526301C4865578575BE178659
SHA-512:	6813E1AFB96716CFCCE1A2071CE3E464E090242FA3D9CB17D69383A66C8034F9D550C94E7ED25052F2A4EA4DA5C764BCFCD8FEFB694A1763FC874A4466BA385F
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yz/r/ujTY9i_Jhs1.png
Preview:	.PNG........IHDR... ... .....D.......PLTEGpL(.`%.g .p .`%.e%.e%.f%.g%.f&.f .` .h%.e%.g%.e .`%.f%.e(.d$.d%.e&.f%.f(.h'.d'.f#.f%.e&.f&.f%.g%.f#.e%.f$.f$.f%.f%.e%.f&.f.j#.g&.f$.f%.f'.f&.f&.e.e%.f.......2tRNS. ...`.... ....@@0.. ppP`.P...p.0..0....p..0..k...gIDATx^m..0....J.MP...q.}...pCN.........\hDm.}...,..-AY`$..\|p......'..s9-...v.....9.....CN...Q..\|D.........}2..cP.....<....q.\|J#\|tY...4R..J.I.E-..a..(.X...+.../.r... ..g.M.41..7...!}..S..n..........p.....C?..........d..!...h.-..5.J~Tv..X.Lw'.t.".d..:....l.......q.X'......}..d..DE..f#ZW.}U..J..5z......UD....].'.x..\.)....,.c..D$D..L.._...i.8.o.......IEND.B`.

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65449)
Category:	downloaded
Size (bytes):	153823
Entropy (8bit):	5.2740073924062925
Encrypted:	false
SSDEEP:
MD5:	FB6EE285F63FD3EB6EBAEA46E8D9C218
SHA1:	473E6F872C09FBF53293EB62173D475396ADF99C
SHA-256:	7D503B5BA7477CAC24DF1139FD0BA27D7D4DC8A7BAD9B7A28476D063F1AB270D
SHA-512:	E4CF202F3BE00644B3D890C0426E870024DCAC206242440A3D71B3E09ABEE05C0768055FC4ED8A7A7ED3C0796DDDDE68BEE2FBCA0864073470D4860E8ECF5699
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/vendors~main~.77fd43f3d675e162dcdf.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[4700],{986907:(e,t,n)=>{"use strict";const r=n(471313);e.exports=r},471313:(e,t,n)=>{"use strict";var r=n(587592),i=n(389408),l=n(376969),o=n(932998);function s(e){throw Error(`Minified Lexical error #${e}; visit https://lexical.dev/docs/error?code=${e} for the full message or use the non-minified dev environment for full errors and additional helpful warnings.`)}function a(e){let t=o.$getSelection();if(null==t)throw Error("Expected valid LexicalSelection");return o.$isRangeSelection(t)&&t.isCollapsed()\|\|0===t.getNodes().length?"":r.$generateHtmlFromNodes(e,t)}function u(e){let t=o.$getSelection();if(null==t)throw Error("Expected valid LexicalSelection");return o.$isRangeSelection(t)&&t.isCollapsed()\|\|0===t.getNodes().length?null:JSON.stringify(f(e,t))}function d(e,t,n){(o.DEPRECATED_$isGridSelection(n)\|\|null!==l.$findMatchingParent(n.ancho

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	17100
Entropy (8bit):	4.31822457999602
Encrypted:	false
SSDEEP:
MD5:	5BD783B712189C94B5C67A6AA9C71F06
SHA1:	95D2F296E1D5F9A17192792A12E6AFE5EA831FA2
SHA-256:	49308B8FA4A540C26752FD19E41337323C641EC2E0142C461FA8010060117783
SHA-512:	F61F516AEEB31EC3835C63F6D1FA9925EBC977DDEEE82360CF7B4C4012C117E98E164A458C8CBEC1735D0BADAD74206FCAEAE1F964779E7E298965D95C5C1B11
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/binary-transparency-manifest-2.2316.5.json
Preview:	{. "version": "2.2316.5",. "hash_function": "SHA256",. "root": "0x88b7a0882149a31ab3fdf7088580e295ae90ae6bb7df33e7aa5834c2c811b35d",. "leaves": [. "0x0031b9862b406fe078e62f0c78e428edba370cd5d2d3e69b00f3d87f19fed8ad",. "0x0271fb402bb798c6b5671c4416641ab0b8c5e4187bae43819af641427bfc56e4",. "0x04c92ab832b96b3e56b390b1d2cac05ba674be701c347877eedd9b1c3a75efbb",. "0x05162868a1a6f22de31a6a94d6a59fc41e774ff8a6d94e85a3b71dd74e2b89ae",. "0x053f3740e3a39350040e7c56d168c37e552e0413b309437726ebe4e133074832",. "0x054bd7673e7f4355bbbe672d7a1ae94c5aec9cd5df08673c11e48c471fffed1f",. "0x05f54c2f8d5d8f7dc92caa2c49ec06fa6e8e3db6822079d191be7b2d3dab34dd",. "0x078f4833a0c6122a845b78a6e3f61213900e157faace44e8f9f6e36ee2870998",. "0x0826c177a64dbe749aaa5302fc9a57f0ad16f8f3a6c8b3af2a1c14b599e136c2",. "0x08b2c9d0ea4f2110d9a09899a7f5d4d49a2955f5c157f3e2e602862f7fc573dd",. "0x0c7ba75cf9beaa9de4bf9e62af99e0284a3b310ecf793e64895b6ed89bec6c05",. "0x0c9ec405a9a231f1fdac60ff8f2ca

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (937)
Category:	downloaded
Size (bytes):	171999
Entropy (8bit):	5.319669655377151
Encrypted:	false
SSDEEP:
MD5:	62233585ACE18084FE5D2E0641CC5F64
SHA1:	540166675A8885CD30C6587EBA8B683487D07555
SHA-256:	ACC0608D0575414541AD031055DB2BC6620147FCB351E943290C839331F5E0DA
SHA-512:	1D15CA117A594709ACAD2D4F8854C472C34132E571FBAD4B6710A2866684B292B351FD31BA2FF3B085494F91B71F10BAB70311EF5FA7877212A83CB71DACD4F0
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/stylex-56ca9bca146a32fe9d7f220cb815b57d.css
Preview:	.a1m9qzja{flex:1}..aja0x350{text-decoration:none}..ajuzgosp{transform:translateX(50%)}..amxrrayi{transform:scale(.97)}..b4a78re4{transform:rotate(135deg)}..b4xm8rjh{transform:scale(1)}..b5bqnu92{transform:translateY(-240%)}..bglikw2g{transform:scale(.01)}..bj62907l{transition:none}..bnt9nn9b{transform:translate(5px)}..bqte3on1{transform:translateX(-1px)}..bwjm0vhl{transform:rotate(-90deg)}..bxpi4b5r{transform:translate3d(0,0,0)}..byw3xhqn{transition:opacity .3s var(--t-ease),transform .3s var(--t-ease)}..c5h0bzs2{transition:opacity .08s linear}..cgi16xlc{transform:translateZ(0)}..cljgexa3{transform:translateY(6px)}..csshhazd{transition:opacity .15s ease-out}..cxnvdhix{transform:translateX(1px)}..d4g41f7d{transition:opacity .2s ease-in-out}..d7dzraxg{transform:translateX(2px)}..d9ddx5tg{background:linear-gradient(to top,rgba(var(--overlay-rgb),.5),rgba(var(--overlay-rgb),0))}..e3l9pkzr{background:var(--video-player-background)}..e95mh68g{transform:translateX(12px)}..eipqoq80{transform:t

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	134930
Entropy (8bit):	5.119399653547806
Encrypted:	false
SSDEEP:
MD5:	5718D1E120AE30EEACE3231E4FD9E276
SHA1:	248FC220D477E422C015FBD07C5E409A312099C5
SHA-256:	B6B1C335997B44425EA6A0D1F9E49E806B9F6045ABB0A332AF26BD2CAEF09D02
SHA-512:	69F84D355AAA8BDA6B598041E041ECF168EA80A3F10DB37587D53F9AD92C91159ED4859052BCE5DB851001DAEAA87F3003835953915F26AEA154F2628259526D
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/emoji_suggestions/en.json?v=2.2316.5
Preview:	{"0":["0."],"1":["1.","..",".."],"2":["..","2.",".."],"3":["..","..","3."],"4":["..","..","..","4."],"5":["..","5.",".."],"6":["..","..","6."],"7":["..","7.",".."],"8":["..","..","..","8."],"9":["9.","..",".."],"10":["..",".."],"11":["..",".."],"12":["..",".."],"18":[".."],"24":[".."],"30":["..","..","..","..","..","..","..","..","..","..","..",".."],"100":["..",".."],"143":["..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..",".."],"1234":[".."],"!":[".","."],"+1":[".."],"-1":[".."],"...":[".."],"00":["..","..","..","..","..","..","..","..","..","..","..",".."],"1 eye":[".."],"10:00":[".."],"10:30":[".."],"11:00":[".."],"11:30":[".."],"12:00":[".."],"12:30":[".."],"1:00":[".."],"1:30":[".."],"24 hours":[".."],"2:00":[".."],"2:30":[".."],"3:00"

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	688796
Entropy (8bit):	5.82195386773795
Encrypted:	false
SSDEEP:
MD5:	2A6D4873BAD09901D40B2042074271C8
SHA1:	F22CB9047FF2287DCE357DCD5221BC84B5B3F947
SHA-256:	8BC6266FF2FB7C3D4361075941D0F17ACF9E0F236CFB117C0DBB349BEEAD6903
SHA-512:	BB46504BC9FBB6F4B11C35A03D45294DF67491FA52BF2F8AE79011A758B67A503ABFED68A3CCF838173056B65A83196AC34E799E56D8F9ED5F981A15EF9341F2
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/WAWebWorker.3dde23bc110a82095881.worker.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /(()=>{var e={1504:e=>{function t(e,t,r,n,u,i,o){try{var a=e[i](o),s=a.value}catch(e){return void r(e)}a.done?t(s):Promise.resolve(s).then(n,u)}e.exports=function(e){return function(){var r=this,n=arguments;return new Promise((function(u,i){var o=e.apply(r,n);function a(e){t(o,u,i,a,s,"next",e)}function s(e){t(o,u,i,a,s,"throw",e)}a(void 0)}))}}},5526:e=>{e.exports=function(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}},7914:e=>{e.exports=function(e){return e&&e.__esModule?e:{default:e}}},3982:(e,t,r)=>{var n=r(5526);function u(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}e.exports=function(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?u(Object(r),!0).forEach((func

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4455)
Category:	downloaded
Size (bytes):	31687
Entropy (8bit):	5.31626555245383
Encrypted:	false
SSDEEP:
MD5:	53CF96858F0FA7B4FE9BC1B4F3A9C02D
SHA1:	DE2A5C03CA1D612FA7A7A326BEEA5FF3166C3C09
SHA-256:	27144337C4326F58F9C260687651D02B54C30AA75B4E5B84C30D52EEABAB568D
SHA-512:	FA8DBD164ED2EE9B8D579334814EE900D3E051EA763D74EFF787D665961CCBBC28616DBC42FD794687C0EB48C8BAD55CEE989777ED60DD9DC88EEEEDC24F4C41
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/ys/l/0,cross/TNKHSSj45bD.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	._9y16 ._9tjr{font-family:Roboto, Helvetica Neue, Helvetica, Arial, sans-serif}.UIInternpage_Content ._9tjr,._9tjr,._9y16 ._9tjr{align-items:center;background-color:#128c7e;display:flex;height:61px;justify-content:center;max-width:100%;min-width:100%;position:fixed;top:0;z-index:1000}._9tjr._aerl,._abp-{background-color:#fff;height:56px}._9tjs,._9y16 ._9tjs{align-items:center;display:flex;justify-content:space-between;max-width:100%;padding-left:8px;padding-right:8px;width:90%}._9tjt{align-items:center;display:flex}._9tju{align-items:center;display:flex;justify-content:space-between;min-width:80%}._9tif,._9tij,._9tig{display:none}._9tii,._9vc_,._9tih{display:block}._9tju{justify-content:flex-end;min-width:unset}._9tjt{width:80%}._9vc_,._9y16 ._9vc_{color:#fff;font-size:17px;font-weight:500;line-height:26px;margin-left:20px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}._9y1a{display:none}._9yl6 ._9y1a{display:block}._9v92 ._9tjr{box-sizing:content-box;padding-bottom:61px;po

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18225)
Category:	downloaded
Size (bytes):	21761
Entropy (8bit):	5.521105689001034
Encrypted:	false
SSDEEP:
MD5:	034B050F4DD80D6D358D43830B9D19C6
SHA1:	D0CBC2D32412642A6644F8FA217428BB265FE3F2
SHA-256:	BBA24454A57EE586F67095D714253CDD96FF01A0CBC2F3155D02B861F99D0F04
SHA-512:	001F8950EE54EC93EE961F5DDA7DD18D43ED187F9057FB9E49D1B1F409AC4EBC0F73E383BF28E7403FFA5A005CAFAC25F11FA1F34ACF17753B9EB63D9C3637C9
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main~.ba0e144e1901d3f008c3.css
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.._38r4-{position:absolute;top:7px;box-sizing:border-box}html[dir=ltr] ._38r4-{right:7px}html[dir=rtl] ._38r4-{left:7px}.-Jnba,._2iNbI,._3xdht,._38r4-{position:absolute;z-index:100}.-Jnba{top:5px;color:var(--icon-lighter)}html[dir=ltr] .-Jnba{right:7px}html[dir=rtl] .-Jnba{left:7px}._2iNbI{top:4px;color:rgba(var(--primary-rgb),.55)}html[dir=ltr] ._2iNbI{right:8px}html[dir=rtl] ._2iNbI{left:8px}._3sHED{position:absolute;top:7px;z-index:100;height:20px;overflow:hidden;font-size:14px;line-height:20px;color:var(--input-placeholder);text-overflow:ellipsis;white-space:nowrap;pointer-events:none;transition:opacity .14s linear}html[dir=ltr] ._3sHED{right:10px;left:65px}html[dir=rtl] ._3sHED{left:10px;right:65px}.os-mac ._3sHED{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}._1biMM{opacity:0}._3wQ5i{position:relative;z-index:100;box-sizing:border-box;display:flex;flex:none;align-items:center;height:49px;transition

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8775)
Category:	downloaded
Size (bytes):	162239
Entropy (8bit):	5.555894361470511
Encrypted:	false
SSDEEP:
MD5:	0A357D431AE85C6AD5E7853E431AFFCC
SHA1:	F3933C9615A187D5BA4CFCEAD7A8D7EF2B494166
SHA-256:	12DED94FB165079E2C703BCC583FF2FD94DB0C67F7519A2FC9681AE2BE2193D7
SHA-512:	C07FEF8FFBC0FCECA7549EF29A8527D638F088AF0FBC266B7A210692FD75A72E4D265233773DBC446574ECB69EEA00AFB3C241054957B17F1DDAA62F7090AE45
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main.179b2d08c29df6bf6d98.css
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /..sU45s{position:absolute;z-index:1000;display:flex;align-items:center;justify-content:center;width:100%;height:100%}html[dir] .sU45s{text-align:center;cursor:pointer}._2Z8rO{width:50px;height:50px;line-height:50px;color:var(--inverse)}html[dir] ._2Z8rO{padding:35px;margin:0 auto 35px;text-align:center;border-radius:50%}._1ab4u{line-height:normal}html[dir] ._1ab4u{margin:0 20px}html[dir] .sU45s ._2Z8rO{background-color:rgba(var(--teal-rgb),.6)}.sU45s ._1ab4u{color:var(--teal)}._2Z8rO svg{width:50px;height:50px}.._2XdMx{display:flex;align-items:center}._1sPvB{color:var(--panel-header-icon)}._3qNGb{color:var(--icon-strong)}._37e4A{color:var(--inverse)}.rOo0o>._3ndVb{height:24px;width:24px;justify-content:center}._2XdMx>span,.rOo0o>._3ndVb{display:flex;align-items:center}._3OtEr{position:relative;flex:none;height:100%;transition:background-color .3s ease}html[dir] ._3OtEr{border-radius:50%}html[dir=ltr] ._3OtEr{margin-left:10px}h

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (11446)
Category:	downloaded
Size (bytes):	73987
Entropy (8bit):	5.466903931302762
Encrypted:	false
SSDEEP:
MD5:	BC250C39A585A75F6FEED1CB1EEAB55E
SHA1:	24E8294196810ADD8F1BCA5600B25D12C9D04FE4
SHA-256:	9345BC6F10D8130F6C3621265E4BEE6F2A06CDEA5DA514CE3DE6DC74B8CE0423
SHA-512:	911B1FF3275CCC3048779E708E80359803B29DF9A2F646E97819F602CA8B8756994599A526DB248741317DB1DB844693AB77E0D850E94B0FD3E3F41739DB15E0
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3iqES4/yR/l/en_US/16DjBt7WCkM.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("QueryString",[],(function(a,b,c,d,e,f){function g(a){var b=[];Object.keys(a).sort().forEach(function(c){var d=a[c];if(d===void 0)return;if(d===null){b.push(c);return}b.push(encodeURIComponent(c)+"="+encodeURIComponent(String(d)))});return b.join("&")}function a(a,b){b===void 0&&(b=!1);var c={};if(a==="")return c;a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=",2),f=decodeURIComponent(e[0]);if(b&&Object.prototype.hasOwnProperty.call(c,f))throw new URIError("Duplicate key: "+f);c[f]=e.length===2?decodeURIComponent(e[1]):null}return c}function b(a,b){return a+(a.indexOf("?")!==-1?"&":"?")+(typeof b==="string"?b:g(b))}c={encode:g,decode:a,appendToUrl:b};f["default"]=c}),66);.__d("isAdsExcelAddinURI",[],(function(a,b,c,d,e,f){var g=new RegExp("(^\|\\.)fbaddins\\.com$","i"),h=["https"];function a(a){if(a.isEmpty()&&a.toString()!=="#")return!1;return!a.getDomain()&&!a.getProtocol()?!1:h.indexOf(a.getProtocol())!==-1&&g.test(a.getDomain())}f["default"]=a})

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (505)
Category:	downloaded
Size (bytes):	566
Entropy (8bit):	5.342193648426921
Encrypted:	false
SSDEEP:
MD5:	ED1DCBE4D50504947C4849E233E2A820
SHA1:	4C18424FDBEEFBF2090D5B7839C03A8D926E3559
SHA-256:	0826C177A64DBE749AAA5302FC9A57F0AD16F8F3A6C8B3AF2A1C14B599E136C2
SHA-512:	3371AD8BF3B28C67EF9D57C9042348DDAAC48E821FF449E7453E8E79A0B6B5594789B64B6E7A6704703359EA301157829B0809A96FE84CFF81484DF2D6CD4784
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/locales/en.065b1e22e67f6eb13e0b.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[6933],{80610:(e,n,t)=>{"use strict";var u=t(595318);Object.defineProperty(n,"__esModule",{value:!0}),n.default=function(){return f.apply(this,arguments)};var l=u(t(348926)),s=u(t(138097));function a(){return"undefined"==typeof fetch?null:fetch("/emoji_suggestions/en.json?v=2.2316.5").then((e=>e.json()))}function f(){return(f=(0,l.default)((function*(){return[s.default,null,yield a()]}))).apply(this,arguments)}}}]);

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1587
Entropy (8bit):	4.621475826394845
Encrypted:	false
SSDEEP:
MD5:	7BB7990889296FAE93DDA06259270540
SHA1:	6A5586358C1AA446680E151AC182063DFE1BC2C4
SHA-256:	CF597AD08FD08E692A793C5EE61CED5C689007361AD3F6BAC1C506E8CD0270E3
SHA-512:	0C7702AE9BD58EC26DFC1BB883F361C9E98010AF18FE0825FCAF2E766639834589BA3CB36822AE4B035DD891AEF4A637AFCC629E89926360E89EC5CD2F0AA7A1
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/manifest.json
Preview:	{. "name": "WhatsApp Web",. "short_name": "WhatsApp Web",. "start_url": ".",. "display": "standalone",. "background_color": "#f0f2f5",. "theme_color": "#f0f2f5",. "description": "Quickly send and receive WhatsApp messages right from your computer.",. "icons": [. {. "src": "./whatsapp_pwa_icon_16.png",. "sizes": "16x16",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_32.png",. "sizes": "32x32",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_60.png",. "sizes": "60x60",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_64.png",. "sizes": "64x64",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_90.png",. "sizes": "90x90",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_128.png",. "sizes": "128x128",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_192.png",. "sizes": "192x192",. "type": "

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65475)
Category:	downloaded
Size (bytes):	598798
Entropy (8bit):	5.568792988944443
Encrypted:	false
SSDEEP:
MD5:	02A6EFFA8685C35827296EAD5D4C265B
SHA1:	33B787CAB1D430C280BFE8A6DA37995383D5623B
SHA-256:	98DCAE12D6C3BAFF8A9935FDB6818F1827281302FD618B05DDE46FB8AE18B250
SHA-512:	726527F195BD65AC8925687A187CF346EE8CC77133A7051296ED7E4255C2DD47E1EC20FB87629A0DF3DA542134E779775F989A35BC470C4DA6B28EEACC6A15D2
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/vendor1~app.93f2846fd0de96e2ec08.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[6177],{214462:(e,t,n)=>{!function(e){"use strict";var t=function(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;t++)n[t]=e[t];return n},r=function(){throw new Error("no PRNG")},i=new Uint8Array(16),o=new Uint8Array(32);o[0]=9;var a=t(),s=t([1]),u=t([56129,1]),l=t([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),c=t([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),f=t([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),d=t([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),h=t([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function p(e,t,n,r){e[t]=n>>24&255,e[t+1]=n>>16&255,e[t+2]=n>>8&255,e[t+3]=255&n,e[t

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5542)
Category:	downloaded
Size (bytes):	58527
Entropy (8bit):	5.494584547103978
Encrypted:	false
SSDEEP:
MD5:	CB28B0389A5A99CDD80294EB84D1D774
SHA1:	946F01AFCEE0481B8A8570FE81692DB7134CD14A
SHA-256:	DEF5F8F669066C454359E0E4AC291747D0A4FF9A0E58A852EE1BEF87959CA9FC
SHA-512:	4C398687B030748C6190B7F7FBD9DD0D672072047295676D101B18D63BD377F07459DE3CB2CAFF6D976A2BF2B7197597DFE6D473D691EC6271CBCFEBF0C5504B
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yZ/r/CBGEnxzDw4z.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("GenderConst",[],(function(a,b,c,d,e,f){e.exports={NOT_A_PERSON:0,FEMALE_SINGULAR:1,MALE_SINGULAR:2,FEMALE_SINGULAR_GUESS:3,MALE_SINGULAR_GUESS:4,MIXED_UNKNOWN:5,NEUTER_SINGULAR:6,UNKNOWN_SINGULAR:7,FEMALE_PLURAL:8,MALE_PLURAL:9,NEUTER_PLURAL:10,UNKNOWN_PLURAL:11}}),null);.__d("IntlVariations",[],(function(a,b,c,d,e,f){e.exports={BITMASK_NUMBER:28,BITMASK_GENDER:3,NUMBER_ZERO:16,NUMBER_ONE:4,NUMBER_TWO:8,NUMBER_FEW:20,NUMBER_MANY:12,NUMBER_OTHER:24,GENDER_MALE:1,GENDER_FEMALE:2,GENDER_UNKNOWN:3}}),null);.__d("EventListenerImplForBlue",["Event","TimeSlice","emptyFunction","setImmediateAcrossTransitions"],(function(a,b,c,d,e,f,g){function h(a,b,d,e){var f=c("TimeSlice").guard(d,"EventListener capture "+b);if(a.addEventListener){a.addEventListener(b,f,e);return{remove:function(){a.removeEventListener(b,f,e)}}}else return{remove:c("emptyFunction")}}a={listen:function(a,b,d){return c("Event").listen(a,b,d)},capture:function(a,b,c){return h(a,b,c,!0)},captureWithPassiv

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23761)
Category:	downloaded
Size (bytes):	186488
Entropy (8bit):	5.719092487109063
Encrypted:	false
SSDEEP:
MD5:	FEA98D60EE1FBBB7D2C910B7BDF8A5A0
SHA1:	1D989C6AEE72106142979BBDA38B639478E4475C
SHA-256:	8B35FC3471696943A36FED96B2F06069DD4A8CE523CB86A11B8F4C722731B6A0
SHA-512:	D7EE77071935022594BFECA49EFA23EFFF51F4474C799904E844A8F00F04E8FD1F94F27CD00CDCC1DD1504BC6EB914A38EF0E5C8829AC651D7F8DB514D3D8F8B
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/app-2250ada0310a91b6d2d7.css
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.._1M6AF{display:inline-block;font-weight:500;line-height:normal;letter-spacing:1.25px;white-space:pre-wrap}html[dir] ._1M6AF{margin-bottom:5px}html[dir=ltr] ._1M6AF+._1M6AF{margin-left:8px}html[dir=rtl] ._1M6AF+._1M6AF{margin-right:8px}.XTVCs,._3QJHf,._3Sm0b,.c1tHh,.fSZaC,._2VVCB,._2ariv{position:relative;font-size:14px;text-transform:uppercase;transition:box-shadow .18s ease-out,background .18s ease-out,color .18s ease-out}html[dir] .XTVCs,html[dir] ._3QJHf,html[dir] ._3Sm0b,html[dir] .c1tHh,html[dir] .fSZaC,html[dir] ._2VVCB,html[dir] ._2ariv{padding:10px 24px;border:1px solid transparent;border-radius:3px}html[dir] ._1M6AF:hover{box-shadow:0 2px 7px rgba(var(--shadow-rgb),.09),0 1px 2px rgba(var(--shadow-rgb),.05)}html[dir] .n-BsL{box-shadow:0 0 0 2px var(--button-focus),0 0 0 4px var(--button-focus-outline)}._3Sm0b{color:var(--button-secondary)}html[dir] ._3Sm0b{border-color:var(--button-secondary-border)}._3Sm0b:not(._16

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3566 x 830, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	29465
Entropy (8bit):	7.8573324538118525
Encrypted:	false
SSDEEP:
MD5:	6BD7AAD7D4B0DC00D4ADFDF6F0CBF399
SHA1:	3445447C81CE085CBF3165822DA472156A1949ED
SHA-256:	0DBCD72A5BCFD55A91EAFA6C362C67E1D434016FC85308E17F99AF100565BE0B
SHA-512:	8DB874A322B65BA06D7BE3B41BF469CBCE7FBE496666D077E6FE02DEA079C2EA4C9A653EAA7CA48F5BF360BE1F1ED4B80AD8FCF94697D497BB59B6F710E7B28C
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/y7/r/DSxOAUB0raA.png
Preview:	.PNG........IHDR.......>......r.....3PLTEGpL%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.foS.+....tRNS... ..`.@.0.pP.X..Z..r.IDATx^..Y..7..P..$.#...v.O.B..V....9...."N.._[.p._8..e.......r.k.}.#...#...n........T_....~........-....>...R..Z.w.k."....0....^u.../...@..z..w.S.>....=...X.4......y:j;.zLC.;.......U.5.)~....y.v=K.w......\.v]......%.v.5......Q..)......0o...g.[......ni...{<......v..6.s.......?.x....4.c{...........gZ......0l}.^......'.....z....@.~.z.{\.......0v%.....tc.5.c.+......~..zg\|...Sm..K-u.....z..%.......85u..............s....0..9.3.u.....}...~..........Y.....>Tg.....]..9.....N...!.......5..#..@?.......LK.Z.\|.........@.......=...........a.......XJ\|....}iw.-...@..s.....P.....B...C..#.....<..`.)^...`........P.v7J:............. .vV........>.......v... ..=........8.....8............P.v-,{.......s..u..@E.......`..C.....6..#.....F{.?.d.....v..........\|....=.....W{}..b.w9.....Rk.9o./s.V..s>j.w...........R...R..k].....`....R.....o......t....<.._

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 38, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	7.63976027729966
Encrypted:	false
SSDEEP:
MD5:	C4B5A3B429735F5BAEBAE24C265AA70B
SHA1:	7116B37D52C3562E71F1BAACA53F8676F65939BE
SHA-256:	2EF47EFE21BD38445E6D97A32ED9F20CF53B0D1B429E9B35FEC31188F60E2564
SHA-512:	88720D26601237196A6DA46F8AE9F2C84ECBB85BC3DFC68999C7F1B78405ECB20A6DB89CB8968BE41DD7E22EC19A7ACB0FBC9C14053A12C1BD7874C330650CDF
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yJ/r/Qhrnh5evyPV.png
Preview:	.PNG........IHDR.......&.....t.`....HPLTEGpL......................................................................z......tRNS...p@. `....P0....._o^......IDATx^.k.. .....t....e.d.fs.=...e.px...d..,.O...77\.\1U..p-....v)....6:.iS...F<.T.p.v........Dx...9..t...c.g......kjM..L....h(..xR..ZG.C..1w..^o#Xp..m!'....>n......J..:.....Z...........rl.Lz40"..\|..L.t.K..tQ.........X..!m..-..w....o.B..,9..,...'.B[...!.&..b<...\...7.YzEP=...."I.1._..G.)b...V..p.NML.n.m}...p+...2..OvW..Gv.5!..`.[.....Yy.U.......qu..\|..E...w.j.>.yV.e......+K...s.L)T....1{."... @.`i.'H..Y....rK...1k.j.....QB...{[.......4...........N .1..r)/...s.z.N.$.>..c.7......}.G2+...k.p.zd.......#..p...M....`......o..H.}~."y...AH....c..6B:^./..^8....0l3...pM.K....cA..<...&!.X...5d..T.......AB....I.){..V..0vj~.....U..".[...j...Jr...O.Q:(.......{s.....].C....:......2....2....c...3H..TU...(>I...^....m@.bq...J..8...W9,h..k.Y..H....."..Wy3db......S..Q..VhHZ...p>..-.m...<..sx.GN.....to.A.;.t...H..C....{

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2334)
Category:	downloaded
Size (bytes):	9767
Entropy (8bit):	5.415574093117592
Encrypted:	false
SSDEEP:
MD5:	DA2870A0DF332FC73A9B08ACEF486E40
SHA1:	30AC281698F2FF7076740F628C87954ECA2EF2F6
SHA-256:	845AFEF5ADA4D1A32781DF750C6108990663AD5CF3EC8CA0D0D26C687D13FF51
SHA-512:	079C8EAF84726155D6626E41309CF2D5714FD83F61258439CD05FD15FFB478248840831DD40C4C9AFBD7A0FF0F1491AC82C79D6A505F2829196D74160FFF97E9
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yo/r/Ho5orKOcOa-.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("XAsyncRequest",["AsyncRequest"],(function(a,b,c,d,e,f,g){a=function(){function a(a){var b=this;this.setAllowCrossPageTransition=function(a){b.$1.setAllowCrossPageTransition(a);return b};this.$1=new(c("AsyncRequest"))(a)}var b=a.prototype;b.setURI=function(a){this.$1.setURI(a);return this};b.setTimeoutHandler=function(a,b){this.$1.setTimeoutHandler(a,b);return this};b.setOption=function(a,b){this.$1.setOption(a,b);return this};b.setMethod=function(a){this.$1.setMethod(a);return this};b.setData=function(a){this.$1.setData(a);return this};b.setHandler=function(a){this.$1.setHandler(a);return this};b.setPayloadHandler=function(a){this.setHandler(function(b){return a(b.payload)});return this};b.setErrorHandler=function(a){this.$1.setErrorHandler(a);return this};b.send=function(){this.$1.send();return this};b.abort=function(){this.$1.abort()};b.setReadOnly=function(a){this.$1.setReadOnly(a);return this};b.setAllowCrossOrigin=function(a){this.$1.setAllowCrossOrigin(a);

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 560 x 315, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16259
Entropy (8bit):	7.968675746259537
Encrypted:	false
SSDEEP:
MD5:	0C6EC69B054FDEB31CF3E5E10290FD8E
SHA1:	5B2D2EF0E3B5824ADDCC34D642769F5F14671411
SHA-256:	D980AB372658F4C7C8F07D730EF6DC67E3FB3471F37928274F915C0308850994
SHA-512:	61947EEFDEFDC94654991E00DE1045CA1E781B69FE1C7305614735926E256F007368F3E904207C8612E03D09E904E03B2A69A4CB297672A49952B2DDA5459CA1
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...;.......K....$zTXtCreator....sL.OJUpL+I-RpMKKM.)..Az..jz......pHYs.........O%......PLTE...222..~.....................111...3339;?....% ...344<>B;=A./0......78<......000OPRwwwtyzggi;;<CEG......]^a...him%&'.....................')+.......#............~~....555.........>>>SSS...ABE.........888...+.FGK...eeg..._`c......??C.....abe...W..XY\...............???UVZPQU...LMQ............[[^.. JKNu{\|559...mnq..........klo........~.........stv... !#...TUW...\|\|}......ppt..........'.............."#&.........................ist......{......b[QTWkxy.....::=........................^ij.......................ITUw........,67!-.0;<bno...Yde...&12...a..^........ ..P[\.&'............T`a.....DNOn\|}6FG......;........>JKL.....~..6ABb..C.....+........=.~?QS......m....[.....C.p.....3..YR........}_.nN.]J...)%~.......v..6rk.....B.U5.Ij........2~2..[..,..;.IDATx...O....!.3........V\_..j.s..).....8.(8g..B..J...T....R.........V..t..f.(.Nr$....T.R$....'/....RJBx>~.."c

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (10442)
Category:	downloaded
Size (bytes):	14039
Entropy (8bit):	5.447404775928492
Encrypted:	false
SSDEEP:
MD5:	1F96973B8187B00B33C4E8355B9B2F2D
SHA1:	7E8D690F0E0C8712432FA2CDD163043495BDEFB7
SHA-256:	08C98DCFA8FA258D7D3E8A679A0DEC1C1FEB7DF167F34EF5A6B8D548C0F9CCD3
SHA-512:	6FCB29331F875C738E50A93128FD37F56C19295ADC5B8C71B6CB312CEFDA755D60E25C362908E4DBC20352C769704253314A4E8F27D12FFC6C487D2B49A7A7E0
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/y9/r/4thXtY6F4n3.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("warning",["WebDriverConfig","cr:1105154","cr:11202","cr:2682"],(function(a,b,c,d,e,f,g){a=b("cr:2682");c=a;g["default"]=c}),98);.__d("getElementText",["isElementNode","isTextNode"],(function(a,b,c,d,e,f,g){var h=null;function a(a){if(c("isTextNode")(a))return a.data;else if(c("isElementNode")(a)){if(h===null){var b=document.createElement("div");h=b.textContent!=null?"textContent":"innerText"}return a[h]}else return""}g["default"]=a}),98);.__d("DateConsts",[],(function(a,b,c,d,e,f){var g=1e3;c=60;d=60;e=24;var h=7,i=12,j=1e3,k=30.43,l=4.333,m=365.242,n=cd,o=ne,p=oh,q=om,r=gc,s=rd,t=go,u=th,v=t*m,w={SUNDAY:0,MONDAY:1,TUESDAY:2,WEDNESDAY:3,THURSDAY:4,FRIDAY:5,SATURDAY:6};Object.freeze(w);function a(a,b){return new Date(a,b,0).getDate()}function b(){return Date.now()/g}var x={instantRange:{since:-864e10,until:864e10+1}};f.MS_PER_SEC=g;f.SEC_PER_MIN=c;f.MIN_PER_HOUR=d;f.HOUR_PER_DAY=e;f.DAYS_PER_WEEK=h;f.MONTHS_PER_YEAR=i;f.US_PER_MS=j;f.AVG_DAYS_PER_MONTH=k;

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49463)
Category:	downloaded
Size (bytes):	134975
Entropy (8bit):	5.337079580815313
Encrypted:	false
SSDEEP:
MD5:	1D956C7876C0EF093AA975DB5645795C
SHA1:	33608DF019AF4FE3A682C6C3D61FBC9518556D11
SHA-256:	92B8D95FCC3571F7B4145E755CB1A7D7994154279B2F14430D82322A78C218BB
SHA-512:	13B312CAFB0B225A8399D740A8F1C1DE1A4E73235C00E52B512880E819DE1CC94D332DF8184352A509781B87185F01AE564F571FF9186F5982951F9F54A7E169
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/y4/l/0,cross/Q0q9dLfcLcl.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3566 x 830, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	29526
Entropy (8bit):	7.868689249946656
Encrypted:	false
SSDEEP:
MD5:	215698B8F763CE612C41964F0F14E507
SHA1:	226059CD8896A857DCA6437F29F58E9F682E4D00
SHA-256:	2FE76A197D3891F7848604C87A945231C4DD2E39A74BDAED45AC5648A0DD72E2
SHA-512:	3DE592395D0D81E928E465A188F58BAF28F4A043C65A651421122C266355471B602C3141D0BF54FD537B78FCDC07A9D618915B6D95A61B4B853418B9DCF6067C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......>......r.....3PLTEGpL.................................................A.*....tRNS... ..`.@.0..Pp6.4_..r.IDATx^..Yv..@Qp..p..Wk.m..k......{....N....X...H..._.........!...{l).........5/..4..5.T......Xs))...bJ.\|~......2.X...O.>....\|.i./5....1.....bm.......`...k..p..........7.....\|.c..m_..K...L....G.....X.a.7..s......zG.....\|...L.7..C......a..J...... ...+.......`^.X...5<....Z...qx......s......b.....!.G.......^........7]\|...Z.N......S\|....Z...'.....2V~z./........+...z...x..v.G.....5...8.......P...5......{.=....X..._....,[}?b..:.........G....,............2.......X;cO'...\b.p..^...`...`[B.............~.b.C.................{....@..>....'.....T?.....pg.x.....@.9....0.X_.1.....p...R.......k3...#..............N....Z.l...X..(......`M.7>.......6..~.....k.Hk......'.........N...s.......`:..P......b......Vo.a.?...P.]...c...y.7.1....../...%....=.d.....0......0....,...76........K).3.....7.MJ)..s............`..!mn......R..-...s.X9.r.....h....o;.+W..

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2605)
Category:	downloaded
Size (bytes):	2818
Entropy (8bit):	5.307759751583872
Encrypted:	false
SSDEEP:
MD5:	A3EBD7C55E737EF3A0F01A98FB02379B
SHA1:	7E3D276F436D98F1F85EA59E94CFD8C4B91590AE
SHA-256:	0DB0F25E050A0D52BEA0D34475A85A10E6B23B1A1A56E21BED8DBE86EB5B3FC2
SHA-512:	760499379126B335A4277DAF5FBFC57BFE9E58A788DCB19DCAD286C9C03F650018D1A9DBBB8408B03C26C9759E6021EBBFC88B527EFABF42E2851016699DBF90
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/ya/r/ZL1A46FYUm6.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/../*. License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. */.__d("body-scroll-lock-3.1.5",[],(function(a,b,c,d,e,f){"use strict";var g={},h={exports:g},i;function j(){!function(a,b){if("function"==typeof i&&i.amd)i(["exports"],b);else if("undefined"!=typeof g)b(g);else{var c={};b(c),a.bodyScrollLock=c}}(this,function(a){Object.defineProperty(a,"__esModule",{value:!0});var b=!1;if("undefined"!=typeof window){var c={get passive(){b=!0}};window.addEventListener("testPassive",null,c),window.removeEventListener("testPassive",null,c)}function d(a){return i.some(function(b){return!(!b.options.allowTouchMove\|\|!b.options.allowTouchMove(a))})}function e(a){a=a\|\|window.event;return!!d(a.target)\|\|1<a.touches.length\|\|(a.preventDefault&&a.preventDefault(),!1)}function g(){void 0!==m&&(document.body.style.paddingRight=m,m=void 0),void 0!==l&&(document.body.style.overflow=l,l=void 0)}var h="undefined"!=typeof window&&window.navigator&&window.navigator.platform&&(/iP(ad\|ho

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1984)
Category:	downloaded
Size (bytes):	6518
Entropy (8bit):	5.267299812441108
Encrypted:	false
SSDEEP:
MD5:	763D5D48DDAB8C42085F4C78EC914CC1
SHA1:	EE6DCB20539CC6530926A0EBC60ABF576D04CF3B
SHA-256:	D1BF1AC5635A1BEA44EAAE82F5E19BF981D48BA9A50A9DEBA0DAD51B3A0BEB18
SHA-512:	5A11EF5B7FB9574F4CC91869E1F7213A69279FEA1332225A31E2480E6B8EA410F60271B0EBD9E023E3B2BF2ED12BADD376E334128391ED41093419549E44D64F
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/ys/r/ioxK2Ojkb1E.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("EventEmitterWithValidation",["BaseEventEmitter"],(function(a,b,c,d,e,f){"use strict";a=function(a){babelHelpers.inheritsLoose(b,a);function b(b,c){var d;d=a.call(this)\|\|this;d.$EventEmitterWithValidation1=Object.keys(b);d.$EventEmitterWithValidation2=Boolean(c);return d}var c=b.prototype;c.emit=function(b){if(this.$EventEmitterWithValidation1.indexOf(b)===-1){if(this.$EventEmitterWithValidation2)return;throw new TypeError(g(b,this.$EventEmitterWithValidation1))}return a.prototype.emit.apply(this,arguments)};return b}(b("BaseEventEmitter"));function g(a,b){a='Unknown event type "'+a+'". ';a+="Known event types: "+b.join(", ")+".";return a}e.exports=a}),null);.__d("mixInEventEmitter",["invariant","EventEmitterWithHolding","EventEmitterWithValidation","EventHolder"],(function(a,b,c,d,e,f,g,h){"use strict";function a(a,b,c){b\|\|h(0,3159);var d=a.prototype\|\|a;d.__eventEmitter&&h(0,3160);a=a.constructor;a&&(a===Object\|\|a===Function\|\|h(0,3161));d.__types=babelHelpers["e

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	17685
Entropy (8bit):	7.97098165814575
Encrypted:	false
SSDEEP:
MD5:	20A60490C79A80D9A4850EB1E1679586
SHA1:	FC218DB5306F55EE61CCF62E71EF1CF18994B200
SHA-256:	659F7090844885D73DFE09BF7F0A5590BDDF7C387FA90956D76BB209E2B2D142
SHA-512:	ED9A104D3E892F3F84B85BA51A0EB0A44FB73B14917EBE8EA122FCD97CF9D37ED19FC51EC56627467D43EF9F1E9D3EEFCB487184A85886B01E93609D110C8894
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yB/r/_0dVljceIA5.png
Preview:	.PNG........IHDR.............k.XT....PLTE....................................................................................................................................................................................................................................................................................................................................................................................."....CPIDATx^..1r.!..P....}.w.i..0......N..N...............C.\.D5.SJ.bV2.._..\L....."..X...J....[.$.@s.l.#.H..Y....M'...i.4.5+.N.JSh,.p. ..........+.P.Mh9......'t......+BU..L...0.h..0.-4.c8.q....4H...F..74L6..C.78.E.&..*uS.R.>..S..........u.._....5..o.U...].G.pw=.8..0...5....~..............f..Jv.Q.ed..Y..<..EC.....i@K...y%4.1...Y.%w7..8. _?i...@...A..A#h.......7........p;@....n....}...6..`t.......6........nM7..t3..i.a.a...!_.....{.....D@.`....!AFn%;j.........C.............h,.$.)._.......k.O..Z.f ......a .B.N. p...1.\|-...+.'l`..C...!...S..6..@....H./..

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	249969
Entropy (8bit):	5.863785387829829
Encrypted:	false
SSDEEP:
MD5:	8AB914B33A56FFA80CA1DE0819A70684
SHA1:	0A103D668F19BD5529DE831446389EABD85F3550
SHA-256:	B32CB4726155800367B1E44AF2FD940B77AED84CC9BAA11C0381BF35DD993C98
SHA-512:	25C7DE99552202067965AF9D381F732E1A7DA5AADEA450F20BE3ABA5561494686B9FB4A6538EDE324D9E677B311ADF3B7CA010C019E41E9D89AE092E9CCB44C8
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/libsignal-protocol-ee5b8ba.min.js
Preview:	!function(){var A=void 0,e={};window.libsignal={};var t,r=void 0!==r?r:{},n={};for(t in r)r.hasOwnProperty(t)&&(n[t]=r[t]);var g=[],o=!1,I=!1,s=!1,f=!1;o="object"==typeof window,I="function"==typeof importScripts,s="object"==typeof A&&"object"==typeof A.versions&&"string"==typeof A.versions.node,f=!o&&!s&&!I;var a,h,B,C,E="";function u(A){return r.locateFile?r.locateFile(A,E):E+A}s?(E=I?require("path").dirname(E)+"/":__dirname+"/",a=function(A,e){var t=oA(A);return t?e?t:t.toString():(B\|\|(B=require("fs")),C\|\|(C=require("path")),A=C.normalize(A),B.readFileSync(A,e?null:"utf8"))},h=function(A){var e=a(A,!0);return e.buffer\|\|(e=new Uint8Array(e)),d(e.buffer),e},A.argv.length>1&&A.argv[1].replace(/\\/g,"/"),g=A.argv.slice(2),"undefined"!=typeof module&&(module.exports=r),A.on("uncaughtException",(function(A){if(!(A instanceof BA))throw A})),A.on("unhandledRejection",x),r.inspect=function(){return"[Emscripten Module object]"}):f?("undefined"!=typeof read&&(a=function(A){var e=oA(A);return e

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15399)
Category:	downloaded
Size (bytes):	15482
Entropy (8bit):	5.375274650615833
Encrypted:	false
SSDEEP:
MD5:	16AF8B85A2B772BE2402812944F5EA57
SHA1:	975121BFA59442A6653559835E979AEFBD77F3E7
SHA-256:	7D3AD4F40E68DC064CFF736CDC0B01C5D1A1E2B9572C53AC85A93F9CB68302E2
SHA-512:	1A27788AC95DA0448031617A78DDF4D1DA3FA6EC9FA1343C6447BAD62377D55AEB683E47ED0661EF64E32EE63C930204B6A782A228A804768910B76DF152109C
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/runtime.8ccb8e636a8305030f8e.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /(()=>{"use strict";var e,a,l,c,o,d,s,f={},b={};function n(e){var a=b[e];if(void 0!==a)return a.exports;var l=b[e]={id:e,loaded:!1,exports:{}};return f[e].call(l.exports,l,l.exports,n),l.loaded=!0,l.exports}n.m=f,n.amdO={},e=[],n.O=(a,l,c,o)=>{if(!l){var d=1/0;for(b=0;b<e.length;b++){for(var[l,c,o]=e[b],s=!0,f=0;f<l.length;f++)(!1&o\|\|d>=o)&&Object.keys(n.O).every((e=>n.O[e](l[f])))?l.splice(f--,1):(s=!1,o<d&&(d=o));s&&(e.splice(b--,1),a=c())}return a}o=o\|\|0;for(var b=e.length;b>0&&e[b-1][2]>o;b--)e[b]=e[b-1];e[b]=[l,c,o]},n.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return n.d(a,{a}),a},l=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,n.t=function(e,c){if(1&c&&(e=this(e)),8&c)return e;if("object"==typeof e&&e){if(4&c&&e.__esModule)return e;if(16&c&&"function"==typeof e.then)return e}var o=Object.create(null);n.r(o);var d={};a=a\|\|[null,l({}),l([]),l(l)];for(var s=2&c&&e;"object"==typeof s&&!~a.indexOf(s);s

Static File Info

⊘No static file info

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Chrome Cache Entry: 241

Chrome Cache Entry: 244

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 256

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 265

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 276

Chrome Cache Entry: 277

Chrome Cache Entry: 278

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Static File Info

Windows Analysis Report
https://chat.whatsapp.com/H193ChGfll800H9BkVkEDb