Edit tour

Windows Analysis Report
https://wa.me/447493588242

Overview

General Information

Sample URL:	https://wa.me/447493588242
Analysis ID:	831168

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 1580 cmdline: "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE" /PIM NoEmail MD5: CA3FDE8329DE07C95897DB0D828545CD)

chrome.exe (PID: 6288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://wa.me/447493588242 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 7932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4188 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Source: unknown

DNS traffic detected: queries for: wa.me

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.132
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.212.131

Source: classification engine

Classification label: clean0.win@31/128@13/93

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://wa.me/447493588242
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4188 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4188 --field-trial-handle=1780,i,15502478451113525777,14202224365027193871,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\alfredo\AppData\Local\Microsoft\Office\16.0\Feedback

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://wa.me/447493588242	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.20.35	true	false	high
mmx-ds.cdn.whatsapp.net	157.240.20.52	true	false	high
accounts.google.com	142.250.186.45	true	false	high
wa.me	157.240.20.52	true	false	unknown
www.google.com	172.217.16.132	true	false	high
clients.l.google.com	172.217.16.206	true	false	high
www.facebook.com	unknown	unknown	false	high
scontent.whatsapp.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
api.whatsapp.com	unknown	unknown	false	high
web.whatsapp.com	unknown	unknown	false	high
www.whatsapp.com	unknown	unknown	false	high
pps.whatsapp.net	unknown	unknown	false	high
static.whatsapp.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.whatsapp.com/send/?phone=447493588242&text&type=phone_number&app_absent=0	false	high
https://web.whatsapp.com/	false	high
https://www.whatsapp.com/download	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.45	accounts.google.com	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.95	unknown	United States	15133	EDGECASTUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
157.240.20.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
157.240.20.52	mmx-ds.cdn.whatsapp.net	United States	32934	FACEBOOKUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	831168
Start date and time:	2023-03-21 07:40:14 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://wa.me/447493588242
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	1
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@31/128@13/93

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, usocoreworker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 34.104.35.123
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, login.live.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Created / dropped Files

C:\Users\alfredo\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.046934824652655
Encrypted:	false
SSDEEP:
MD5:	2570F596196CDE21D4FBA64496264D7F
SHA1:	05DE2D7C6580ADB9E9CC5313775D84C3662CB135
SHA-256:	CAB15E127C575712C8B994B0B2D75BC66B366C7D1F562B8D7D5BCA0DF9F4CCE3
SHA-512:	F50B97BE893DE204F81ECC7BD27777C46ED4A2A4C156DCA20970F89FE5A7DFEF4E7AF6B687ECCEB3A00475332CFD64CF58C1A4630CF9C87500A25EA57FC04EB1
Malicious:	false
Reputation:	low
Preview:	.6...AAAAAAA...AAAAA...A.A.A/ALAAAAAAAAAAAbA5AtA.!.AGA.A.bbA.A`A.].A%A.A...A AHA...AVA.A.n.AKA.A6d.A.A.A6.A~AEA...6.A.A..Ab.A...A...A...An.LA..bA...A..bA..#A..bA5..A...6#.qA.^tA..&A.5.6..A..bA..A...6`.~A.G.6N..A..bA2..A...A6#.A.-.A.#.A...A.#cA...6#.A.bA..A...An..A...A..A..bA..A. bA..A.tbA.SAA.AbA.S.A.6.AF..A.L.A`..A...AN.A...A..(A.}.A...A.1.A...A..A...A...AV..A..AQ.yA._.AE.MA...A\|.A...AU..A...6...A...6...A.?.6...A.H.A..A.9bAK.XA...A...A...A..DA..A...A.%bAZ.A.;b.q..A.#b...7A...Aw..A68.AAA.AtA.6...........................................................

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10804
Entropy (8bit):	4.481624126994836
Encrypted:	false
SSDEEP:
MD5:	2928664FE1FC6ACA88583A6F606D60BA
SHA1:	2F2FE1CBD0563B3CE3EA79FCDF1549ED244B3993
SHA-256:	A26FC5B38380272C92E9019A2EB8B45542A66814B3E2B203772DB8904B9FB99F
SHA-512:	7D6F8B7E54A4DA3CF81C767B4AA40C3B04BAFE35F2DD77B85944DE4442F0B1DD1A8EDA0175DEB4652CF055094ACDC0D4B6E38ABE51C52A3DFBF887481315B347
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/yT/r/DRlZi0ybQQP.svg
Preview:	<svg id="livetype" xmlns="http://www.w3.org/2000/svg" width="119.66407" height="40" viewBox="0 0 119.66407 40">. <title>Download_on_the_App_Store_Badge_US-UK_RGB_blk_4SVG_092917</title>. <g>. <g>. <g>. <path d="M110.13477,0H9.53468c-.3667,0-.729,0-1.09473.002-.30615.002-.60986.00781-.91895.0127A13.21476,13.21476,0,0,0,5.5171.19141a6.66509,6.66509,0,0,0-1.90088.627A6.43779,6.43779,0,0,0,1.99757,1.99707,6.25844,6.25844,0,0,0,.81935,3.61816a6.60119,6.60119,0,0,0-.625,1.90332,12.993,12.993,0,0,0-.1792,2.002C.00587,7.83008.00489,8.1377,0,8.44434V31.5586c.00489.3105.00587.6113.01515.9219a12.99232,12.99232,0,0,0,.1792,2.0019,6.58756,6.58756,0,0,0,.625,1.9043A6.20778,6.20778,0,0,0,1.99757,38.001a6.27445,6.27445,0,0,0,1.61865,1.1787,6.70082,6.70082,0,0,0,1.90088.6308,13.45514,13.45514,0,0,0,2.0039.1768c.30909.0068.6128.0107.91895.0107C8.80567,40,9.168,40,9.53468,40H110.13477c.3594,0,.7246,0,1.084-.002.3047,0,.6172-.0039.9219-.0107a13.279,13.279,0,0,0,2-.1768,6.80432,6.80432,0,0

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	354081
Entropy (8bit):	5.60962081174762
Encrypted:	false
SSDEEP:
MD5:	5AE7593492F4A6F0B2D4ACA16E408028
SHA1:	1777A0FB311612C459CCEED4D4E0A1C170B5F359
SHA-256:	7E6C292E842E1C5837BB889E5D408AEC0A3963CF636C66C8F934AD5E55F41E2A
SHA-512:	701394BF11168068761C607FA7F2B310BA4BF068D2CD4B6AAF17CA2C4939D7416C964641499700B424EEE204867C083ABAAD8776263A1B8CA27CAEA90A590124
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/serviceworker.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /(()=>{var e={4462:(e,t,n)=>{!function(e){"use strict";var t=function(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;t++)n[t]=e[t];return n},r=function(){throw new Error("no PRNG")},o=new Uint8Array(16),i=new Uint8Array(32);i[0]=9;var s=t(),a=t([1]),c=t([56129,1]),l=t([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),u=t([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),d=t([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),_=t([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),f=t([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function h(e,t,n,r){e[t]=n>>24&255,e[t+1]=n>>16&255,e[t+2]=n>>8&255,e[t+3]=255&n,e[t+4]=r>>24&255,e[t+5]=r>>16&255,e[t+6]=r>>8&255,e[t+7]=255&r}function p(e,t,n,r,o){va

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 864 x 312, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7937
Entropy (8bit):	7.858668135540568
Encrypted:	false
SSDEEP:
MD5:	A9F6F636DA63A11039087BF963F30C60
SHA1:	F7B100BB16EB25C98D050A501C6DD26AADCA3DA4
SHA-256:	997C848C330E1DFF680CDFA9913E2D22CE0887CE5DF35981C9D806161AF03441
SHA-512:	043412F7229F0C1E49B6C0759D9C3D56E66BEA2273B1201E3E7902757AD47AFD9E46DD33860E23CEB8F88E2B74E07518A55BA3DA65C095055D0E7547577A5357
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...`...8.......`%....PLTE...www.......P!............~........ @@@...pppPPP...... ......................................444...**...............NNNddd......KKK000.............DDD...,,,...$$$666................AAA......'''...mmmUUU"""....\\\```uuu.........HHH...===WWW...iii......\|\|\|fff.........111....;;;...YYYzzzkkk.........sss..............xxx...999........aaa......FFF......^^^.....qqq888hhh........QQQSSS..............yyy............................q.....IDATx^..!........OL.,n.........@..O.... .....w......2I\|...t..0..`.7].U.E.\.j.. h.`.. .....fr..s..._......................................`...``0.``0.``00.`00...0.................;0...0...........................`P.6MY...1.G_...N.....#.K...^.[...6..0...\|\....3.....:......S.....w.V}....EH..0 .).0.YtXG.)...8.l)E..q.;....*owL.O3.@b....}R..R9.......wF..O.V6\.....[<...`S...0.,0...lmw.....-:..PUR...#......Z6.`f..../..)=...d`2..c....B.T...e...k>.....&...-......;..:.B$2@...+........+.......J.

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65475)
Category:	downloaded
Size (bytes):	591200
Entropy (8bit):	5.573001314707884
Encrypted:	false
SSDEEP:
MD5:	49A2B25B8A975D43B499002E585F238D
SHA1:	BA8208ED3EB6FF71E2EF7A69B6B5AAB37E149744
SHA-256:	4704D1BF899B937BCF40AE8190F14B8E82191D4C2C9DBE98BFBA45098DB28DBA
SHA-512:	F6D23F32370812EEA9D2C4DE79CF3609A696C474E9EF3E2B8CD7A75AF463BE5BC73BAD1DD94B194E6B77916F688C022266A1EC8A55C49AAE620444F3A5CE6E45
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/vendor1~app.0c8e960e5dfd7020f562.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[6177],{214462:(e,t,n)=>{!function(e){"use strict";var t=function(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;t++)n[t]=e[t];return n},r=function(){throw new Error("no PRNG")},i=new Uint8Array(16),a=new Uint8Array(32);a[0]=9;var o=t(),s=t([1]),u=t([56129,1]),l=t([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),c=t([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),f=t([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),d=t([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),h=t([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function p(e,t,n,r){e[t]=n>>24&255,e[t+1]=n>>16&255,e[t+2]=n>>8&255,e[t+3]=255&n,e[t

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4814)
Category:	downloaded
Size (bytes):	15806
Entropy (8bit):	5.414838744001887
Encrypted:	false
SSDEEP:
MD5:	BEEF4B0B5FD2D631BE59544474571C97
SHA1:	105666D8D1AB4C114EC50864D56E1E68B5DF9862
SHA-256:	571FD374E116A215A544D588E403D6CE731A2043B5EA1D7A547F4FEE5E973622
SHA-512:	363EB2A784FD35CD2C578586893CCDD35233BA89FF30A84127EB614BEB243817C01C88E712E72F58949ED0F757F1CB805DEC8F6DE734ED36A91F460A32776EBE
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yw/r/f9QlYKvEKVm.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("uriIsRelativePath",[],(function(a,b,c,d,e,f){"use strict";function a(a){return!a.getProtocol()&&!a.getDomain()&&!a.getPort()&&a.toString()!==""}f["default"]=a}),66);.__d("XAsyncRequest",["AsyncRequest"],(function(a,b,c,d,e,f,g){a=function(){function a(a){var b=this;this.setAllowCrossPageTransition=function(a){b.$1.setAllowCrossPageTransition(a);return b};this.$1=new(c("AsyncRequest"))(a)}var b=a.prototype;b.setURI=function(a){this.$1.setURI(a);return this};b.setTimeoutHandler=function(a,b){this.$1.setTimeoutHandler(a,b);return this};b.setOption=function(a,b){this.$1.setOption(a,b);return this};b.setMethod=function(a){this.$1.setMethod(a);return this};b.setData=function(a){this.$1.setData(a);return this};b.setHandler=function(a){this.$1.setHandler(a);return this};b.setPayloadHandler=function(a){this.setHandler(function(b){return a(b.payload)});return this};b.setErrorHandler=function(a){this.$1.setErrorHandler(a);return this};b.send=function(){this.$1.send();retur

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39974)
Category:	downloaded
Size (bytes):	80920
Entropy (8bit):	5.3255882493506626
Encrypted:	false
SSDEEP:
MD5:	248301C43ADF947B1DE128B43DCD16DF
SHA1:	719CB230706853C22DD8AE653B101EA57BE07681
SHA-256:	5F2FF4E5A1750A05983F07E0F9C88C0F719E27AD7C04B02D17F9A134CF8333E8
SHA-512:	645A9B6C5E3E3CAAEE3DD5A4BF9A7D418B8EE70DBC88831B843B2CF810AAED30EBD9CB9C229813E5C38DCFAAF0E1B44903CEF928F319DAB78A997507866DCA9D
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3i7M54/yt/l/en_US/dL5hsoXnGtF.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("camelize",[],(function(a,b,c,d,e,f){var g=/-(.)/g;function a(a){return a.replace(g,function(a,b){return b.toUpperCase()})}f["default"]=a}),66);.__d("getOpacityStyleName",[],(function(a,b,c,d,e,f){var g=!1,h=null;function a(){if(!g){if(document.body&&"opacity"in document.body.style)h="opacity";else{var a=document.createElement("div");a.style.filter="alpha(opacity=100)";a.style.filter&&(h="filter")}g=!0}return h}f["default"]=a}),66);.__d("hyphenate",[],(function(a,b,c,d,e,f){var g=/([A-Z])/g;function a(a){return a.replace(g,"-$1").toLowerCase()}f["default"]=a}),66);.__d("getStyleProperty",["camelize","hyphenate"],(function(a,b,c,d,e,f,g){function h(a){return a==null?"":String(a)}function a(a,b){var d;if(window.getComputedStyle){d=window.getComputedStyle(a,null);if(d)return h(d.getPropertyValue(c("hyphenate")(b)))}if(document.defaultView&&document.defaultView.getComputedStyle){d=document.defaultView.getComputedStyle(a,null);if(d)return h(d.getPropertyValue(c("hyphe

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	680450
Entropy (8bit):	5.819583496145699
Encrypted:	false
SSDEEP:
MD5:	BB9DAE7EB65BF591855A1522FBFBE656
SHA1:	7C9D5F283A6A9342EA2B13CA5157FF3FD0C92B00
SHA-256:	36103FA2021F34FB3AF552A5995EF2103AA6FD66B9A94EC614C6B4E5981371E0
SHA-512:	CDF2B6F83A344C059AC645A5A4D687AF89E4C3DFCF35B8421A90D6333E9DE2880C427C2F0B1197EB21761211E1068D8A28A5DD0E0C29CC3DE6AC36E24B285847
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/WAWebWorker.0599c1326c99de3c8fb7.worker.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /(()=>{var e={1504:e=>{function t(e,t,n,r,u,i,a){try{var o=e[i](a),s=o.value}catch(e){return void n(e)}o.done?t(s):Promise.resolve(s).then(r,u)}e.exports=function(e){return function(){var n=this,r=arguments;return new Promise((function(u,i){var a=e.apply(n,r);function o(e){t(a,u,i,o,s,"next",e)}function s(e){t(a,u,i,o,s,"throw",e)}o(void 0)}))}}},5526:e=>{e.exports=function(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}},7914:e=>{e.exports=function(e){return e&&e.__esModule?e:{default:e}}},3982:(e,t,n)=>{var r=n(5526);function u(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}e.exports=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?u(Object(n),!0).forEach((func

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48950)
Category:	downloaded
Size (bytes):	137994
Entropy (8bit):	5.338926538000409
Encrypted:	false
SSDEEP:
MD5:	5711CE46C7BA97844886638AD313E7D8
SHA1:	D83DC171E5AD854FC6E42CDF2807AAC0107802B0
SHA-256:	CCE1431C276ED416EA25F54C4CC101D2A7BB37B5F693DCDB99C7A25C90585EC1
SHA-512:	33A759B1FBD1C1087DD829990EF8BC4AE2C8F901CA3189C0188A27EF304DBC5547DDAE7853C7F39551D1CF040896F4894EAAAC4E3507FD3E8ADAB093F9544AC1
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yB/l/0,cross/FmAwSGwZKhH.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6603)
Category:	downloaded
Size (bytes):	6683
Entropy (8bit):	5.033107919956822
Encrypted:	false
SSDEEP:
MD5:	AA7F8D7858530A957F230A6FF511EC8F
SHA1:	57FD50D7FA536341954B835FA1835A7DB339F085
SHA-256:	D1AA6C4AB2DABA84E9082980E75F0BAB05B5C126FE50EC98844A579585C5BA0F
SHA-512:	1247F3598E7BA716293AC290C8BFA80B991551E243F3DF34883778ECC7160DD8D7B383C533D96E1F4B7F5A6291CD499AD7A34093648560466BBB4B5E57068633
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yI/l/0,cross/C2fHuK6eV5E.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.rich-text a.fragment{border:0;box-sizing:border-box;display:block;font-size:0;height:0;line-height:0;outline:none;pointer-events:none;position:relative;text-decoration:none}@media (min-width: 1096px){.rich-text a.fragment{padding-top:121px;margin-top:-121px}}@media (min-width: 768px) and (max-width: 1095px){.rich-text a.fragment{padding-top:104px;margin-top:-104px}}@media (max-width: 767px){.rich-text a.fragment{padding-top:91px;margin-top:-91px}}.rich-text{font-size:14px;line-height:1.45}@media (min-width: 768px){.rich-text{font-size:16px;line-height:1.625;color:#5e5e5e}.rich-text.rich-text--large{font-size:18px;line-height:1.625}}@media (max-width: 767px){.rich-text{font-size:15px;line-height:1.5;color:#282828}}@media (min-width: 768px){.rich-text p,.rich-text ul,.rich-text ol{margin-bottom:31px}}@media (max-width: 767px){.rich-text p,.rich-text ul,.rich-text ol{margin-bottom:21px}}.rich-text sup{font-size:12px;vertical-align:top;display:inline;opacity:.8}.rich-text ol{list-style-ty

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5972
Entropy (8bit):	7.910397098451488
Encrypted:	false
SSDEEP:
MD5:	E336B9F3F460E6C20E4D5E71CDFAD26E
SHA1:	E9F3B05843D83BD683CFB6255B2C17B34B856442
SHA-256:	A56E09B35771741E861D9AC7432BC80DB83DA2620CCD9839A3F1BC2657BBEBFF
SHA-512:	5CD618BE71C0A58AA71B9C587AB9C7D9AE77B59BCAE9888E22D148FEA4EC457D9E0C2BCC4395F442FF614F8C3D105F84E847E2CEB17E20E7B23F9317A1752833
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............R.l.....pHYs.................sRGB.........gAMA......a.....IDATx..M..G...$V.~....a7..I.%..l.qln g#....c.D,....._...rb..U........./.....P.....x.8....wW.{.3.U....T.Oj..w.y..\|T.S#....W'.C+u.%........."/.......kddd.......)CoSb...5A.......rZ..K.#..2.........@.]q.F.("..$...i.0..~.x.....1..#...~....#....`A\....,.Th.....t.5'.cMM..'.a.mJF.Y.{.7....0.D.....q...F$.g..:.....4.o..I...).%!.3>..^.@.~....`.6.B.J...O.....!....B.S9..D... ..#~0...uH..yb.[..r.K....;...p.e.%f ...x...w.....g...X.J...F..6%3.......3.%F.....p.M..t.I.....c...$...1.Qv6....s.)..`..h..y.s.L.$Nz...$.."q.r1$r.......S...'Z.:.b....V.B..#.L_...38......n(o6.L..wa.N....~c....V...o<..,..r.a..\|...f.d...V3.x...1.d7............2g0.@...)i..R.../.C..`f.'....L...?..F..P%!P*....@8TYb\.....@N....]"-......@y...Hi.@.o.u.@Q"J<A).&...a.z..-Jl..J..\.....l.PY.H..@r.wi..4..s.V. ....a.7P..+C.....@EDd1).....E..\..=Z..2-.p!y....Mn.m.q..(...%.v.,`.....=0.s./...?/......i.....a..S4~...q.

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	134930
Entropy (8bit):	5.119399653547806
Encrypted:	false
SSDEEP:
MD5:	5718D1E120AE30EEACE3231E4FD9E276
SHA1:	248FC220D477E422C015FBD07C5E409A312099C5
SHA-256:	B6B1C335997B44425EA6A0D1F9E49E806B9F6045ABB0A332AF26BD2CAEF09D02
SHA-512:	69F84D355AAA8BDA6B598041E041ECF168EA80A3F10DB37587D53F9AD92C91159ED4859052BCE5DB851001DAEAA87F3003835953915F26AEA154F2628259526D
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/emoji_suggestions/en.json?v=2.2312.7
Preview:	{"0":["0."],"1":["1.","..",".."],"2":["..","2.",".."],"3":["..","..","3."],"4":["..","..","..","4."],"5":["..","5.",".."],"6":["..","..","6."],"7":["..","7.",".."],"8":["..","..","..","8."],"9":["9.","..",".."],"10":["..",".."],"11":["..",".."],"12":["..",".."],"18":[".."],"24":[".."],"30":["..","..","..","..","..","..","..","..","..","..","..",".."],"100":["..",".."],"143":["..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..","..",".."],"1234":[".."],"!":[".","."],"+1":[".."],"-1":[".."],"...":[".."],"00":["..","..","..","..","..","..","..","..","..","..","..",".."],"1 eye":[".."],"10:00":[".."],"10:30":[".."],"11:00":[".."],"11:30":[".."],"12:00":[".."],"12:30":[".."],"1:00":[".."],"1:30":[".."],"24 hours":[".."],"2:00":[".."],"2:30":[".."],"3:00"

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4455)
Category:	downloaded
Size (bytes):	38220
Entropy (8bit):	5.3519681041929745
Encrypted:	false
SSDEEP:
MD5:	ED19CEEDC17B0376EB978D927CE65D73
SHA1:	7B284FE6515A4EADF73F6ECDA5FE796E795CC679
SHA-256:	9C01E09111D379CC0D6C2C0BE2C8FDE4B9BA5702F5D4D436888A780C65E15CDD
SHA-512:	81475FA84476A799631BBF071BB6A5E2C0F47EA64B8BCDF8967DD8A58B161F8D727A4CCECEDB4F3926A813111B8F40F6E980E465990349127EB34C106C8285AE
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yg/l/0,cross/gswTU0mAvue.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	._9y16 ._9tjr{font-family:Roboto, Helvetica Neue, Helvetica, Arial, sans-serif}.UIInternpage_Content ._9tjr,._9tjr,._9y16 ._9tjr{align-items:center;background-color:#128c7e;display:flex;height:61px;justify-content:center;max-width:100%;min-width:100%;position:fixed;top:0;z-index:1000}._9tjr._aerl,._abp-{background-color:#fff;height:56px}._9tjs,._9y16 ._9tjs{align-items:center;display:flex;justify-content:space-between;max-width:100%;padding-left:8px;padding-right:8px;width:90%}._9tjt{align-items:center;display:flex}._9tju{align-items:center;display:flex;justify-content:space-between;min-width:80%}._9tif,._9tij,._9tig{display:none}._9tii,._9vc_,._9tih{display:block}._9tju{justify-content:flex-end;min-width:unset}._9tjt{width:80%}._9vc_,._9y16 ._9vc_{color:#fff;font-size:17px;font-weight:500;line-height:26px;margin-left:20px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}._9y1a{display:none}._9yl6 ._9y1a{display:block}._9v92 ._9tjr{box-sizing:content-box;padding-bottom:61px;po

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23455)
Category:	downloaded
Size (bytes):	184683
Entropy (8bit):	5.723789191818897
Encrypted:	false
SSDEEP:
MD5:	53CD14231CA281926E82216F6A8C87CC
SHA1:	84ED24586862E026F1F481331E1CAC56629F292B
SHA-256:	9F290AEBD68C31388792F20A783890B037A7DB6872F44446C855978912458A66
SHA-512:	43E3AF63233B8B054CDEEF6F094D63C15A7153B40080164604023C17794CDF48DCD1918FA9C14A0DC6643597AC91AEA683237CD02964A75090BE7B17B7BE1110
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/app-ed1130a5682b113aa262.css
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.._1M6AF{display:inline-block;font-weight:500;line-height:normal;letter-spacing:1.25px;white-space:pre-wrap}html[dir] ._1M6AF{margin-bottom:5px}html[dir=ltr] ._1M6AF+._1M6AF{margin-left:8px}html[dir=rtl] ._1M6AF+._1M6AF{margin-right:8px}.XTVCs,._3QJHf,._3Sm0b,.c1tHh,.fSZaC,._2VVCB,._2ariv{position:relative;font-size:14px;text-transform:uppercase;transition:box-shadow .18s ease-out,background .18s ease-out,color .18s ease-out}html[dir] .XTVCs,html[dir] ._3QJHf,html[dir] ._3Sm0b,html[dir] .c1tHh,html[dir] .fSZaC,html[dir] ._2VVCB,html[dir] ._2ariv{padding:10px 24px;border:1px solid transparent;border-radius:3px}html[dir] ._1M6AF:hover{box-shadow:0 2px 7px rgba(var(--shadow-rgb),.09),0 1px 2px rgba(var(--shadow-rgb),.05)}html[dir] .n-BsL{box-shadow:0 0 0 2px var(--button-focus),0 0 0 4px var(--button-focus-outline)}._3Sm0b{color:var(--button-secondary)}html[dir] ._3Sm0b{border-color:var(--button-secondary-border)}._3Sm0b:not(._16

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5542)
Category:	downloaded
Size (bytes):	50153
Entropy (8bit):	5.501899535233937
Encrypted:	false
SSDEEP:
MD5:	72429CB73B288F35F9F47D3C81EFA288
SHA1:	2A25C1D827FA494565D822FA796390EC316924C2
SHA-256:	7041305B66770068A6D0FECE453D8CAE3BA38C04DA64DFF18C8E2B2D3BC46851
SHA-512:	6EA1626FCB548AC0692CD7E754439E69C7CE8D4E411DACC2A4AFB9D41F796B8E0777DBF45B6F10D8B19DDDD585339E47A97B93660FBEF794D29FB28419335CC5
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yk/r/0l5IQkqtB78.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("GenderConst",[],(function(a,b,c,d,e,f){e.exports={NOT_A_PERSON:0,FEMALE_SINGULAR:1,MALE_SINGULAR:2,FEMALE_SINGULAR_GUESS:3,MALE_SINGULAR_GUESS:4,MIXED_UNKNOWN:5,NEUTER_SINGULAR:6,UNKNOWN_SINGULAR:7,FEMALE_PLURAL:8,MALE_PLURAL:9,NEUTER_PLURAL:10,UNKNOWN_PLURAL:11}}),null);.__d("IntlVariations",[],(function(a,b,c,d,e,f){e.exports={BITMASK_NUMBER:28,BITMASK_GENDER:3,NUMBER_ZERO:16,NUMBER_ONE:4,NUMBER_TWO:8,NUMBER_FEW:20,NUMBER_MANY:12,NUMBER_OTHER:24,GENDER_MALE:1,GENDER_FEMALE:2,GENDER_UNKNOWN:3}}),null);.__d("EventListenerImplForBlue",["Event","TimeSlice","emptyFunction","setImmediateAcrossTransitions"],(function(a,b,c,d,e,f,g){function h(a,b,d,e){var f=c("TimeSlice").guard(d,"EventListener capture "+b);if(a.addEventListener){a.addEventListener(b,f,e);return{remove:function(){a.removeEventListener(b,f,e)}}}else return{remove:c("emptyFunction")}}a={listen:function(a,b,d){return c("Event").listen(a,b,d)},capture:function(a,b,c){return h(a,b,c,!0)},captureWithPassiv

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16952
Entropy (8bit):	4.3179053822418725
Encrypted:	false
SSDEEP:
MD5:	5FB3F15EB7E55A2113E24F32B4B8FAC4
SHA1:	563E985DDDBC13FF2601C493F79068232B783CA3
SHA-256:	2626AF71D81D2FA46A1BCB3F5E372AA5D4A253B0C2D8D9DB6FCFC996C1C462F6
SHA-512:	26890E7BD2646A31CD00246E04EFA1CE0C2A76371B14187C2934B1024804C36261E8554F64C697E10F86FB6865DE09369E3CC78E23E989FCC5D2D441BF894EDB
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/binary-transparency-manifest-2.2312.7.json
Preview:	{. "version": "2.2312.7",. "hash_function": "SHA256",. "root": "0x4aac4a1ff4e80fbaa0490b47cf1924147647b472587ad8063815b8854d077ee3",. "leaves": [. "0x0031b9862b406fe078e62f0c78e428edba370cd5d2d3e69b00f3d87f19fed8ad",. "0x0271fb402bb798c6b5671c4416641ab0b8c5e4187bae43819af641427bfc56e4",. "0x05162868a1a6f22de31a6a94d6a59fc41e774ff8a6d94e85a3b71dd74e2b89ae",. "0x05f54c2f8d5d8f7dc92caa2c49ec06fa6e8e3db6822079d191be7b2d3dab34dd",. "0x06561fa679447d7dfd32c3dfc373dd13cf5954bfd318231c3cc161f0435cfecf",. "0x078f4833a0c6122a845b78a6e3f61213900e157faace44e8f9f6e36ee2870998",. "0x08b2c9d0ea4f2110d9a09899a7f5d4d49a2955f5c157f3e2e602862f7fc573dd",. "0x0a926e683878329c9f54218a3a97acda5e3afca6341aed7894261dcaaa0a6d2c",. "0x0c7ba75cf9beaa9de4bf9e62af99e0284a3b310ecf793e64895b6ed89bec6c05",. "0x0cbef208204e52166a06c290e2ec27ce152c54a994a66e8960529d36af9e0927",. "0x0e301cd16980ba7f98b0fe1fda867ba007666311f53a2581586cf684ed34c451",. "0x0f4b6eec46321260748a4fb57246d

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2711)
Category:	downloaded
Size (bytes):	34291
Entropy (8bit):	5.386640046391452
Encrypted:	false
SSDEEP:
MD5:	5B0868409824766E38512AC3FBEB47E7
SHA1:	46F9C66D7C26E8DF7DD48B26F482763AA172A089
SHA-256:	CE0EBDBE4DB8C3BA1993ACB8FF1FE02A36CB6E0FE8F3F31ABB45F8E334351862
SHA-512:	4F5479C77CEEEEAAF1C9CC6F0E0623074EB3B63FDD712A8318A2A271F835C39B9303AC51E653937649B485D72188313CAF4D708267CEEE349CA37353018012D5
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yl/l/0,cross/pB-SDILB6R8.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	.fixed_elem,.fixed_always{position:fixed!important}.tinyHeight .fixed_elem{position:static!important}.chrome .fixed_elem,.chrome .fixed_always{transform:translateZ(0)}.tinyHeight .chrome .fixed_elem{transform:none}.._2agf{word-wrap:normal}._2agf._4o_4{display:inline-flex}._55pe{display:inline-block;overflow:hidden;text-overflow:ellipsis;vertical-align:top;white-space:nowrap}.._5f0v{outline:none}._3oxt{outline:1px dotted #3b5998;outline-color:invert}.webkit ._3oxt{outline:5px auto #5b9dd9}.win.webkit ._3oxt{outline-color:#e59700}.i.img{-ms-high-contrast-adjust:none}i.img u{clip:rect(1px, 1px, 1px, 1px);height:1px;left:auto;overflow:hidden;position:absolute;white-space:nowrap;width:1px}..lfloat{float:left}.rfloat{float:right}.._3stn{border:0;border-collapse:collapse;border-spacing:0;width:100%}._9uiu{table-layout:fixed}._3sto td{padding:5px 0}._3stp ._3sto td{padding:0;visibility:hidden}._480u,._480v,._3sts{padding:3px 0 1px 0;text-align:left;vertical-align:top}._3stt ._480u,._3stt ._480

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 344 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	232734
Entropy (8bit):	7.9945526025204865
Encrypted:	true
SSDEEP:
MD5:	F773998D05BBEA0C2A04565905D51117
SHA1:	89597F8A2B4A048DD53EB175B3AAB21F3B8E000A
SHA-256:	275D32E4609A1CEA8BBD446F8D0B41EA4E147655FA741EDEEA3BB6900EB693F0
SHA-512:	582F9EFAF9FBAA3F88A37F2E23CAC00B8FEC3D6AF7A8DDE60F8C83F2D3B7A503E167A1D03C435BEEB18941B4C95AAC5C3258935FBFF226B2767782791CBD068C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X...........n.....pHYs.................sRGB.........gAMA......a.....IDATx.<....{v..w..a.....o.....F..`.S...Bb...q..(.-p.Ru+U.T..N...&.D. .`.la#.BBC...g.g........{D.K.>g..{....g=.Y......j.]....-.R;.xn.Vi.g..m6fya...J.k.M.h....o......].V..........={~rf.vf.....6.=._...e.....oZ..........KZ.m.s.....7>.{...yh.....].;<.<Jlvvn.>q.>....6..rey.g.J[.....6..X..X..6.=.,N..lZ1.X.l..,.......^,..m.vZVX`[.-...<.8.,H...=..+.+.yfv5....X..4I.(...._.X.Z.wWV...U..8.m.....jw..\.QZ.f.w.N..{C..X.^....q..9..Cm..I.{...8H.\fY.......5..J.\.7.{[.b}.E.X....5S=cY.Vk[.........g2..3bk.z.......6...T?..>.......(....%.....o&....]i.\..w..'.^.l.8.s.m..Z..gi...1.O......s.hq.z.r.[oG.7.k-.rm....&g.l...=.....u................y.s.G...7..v.^.~....l..(-+Sk.-}..i...((,.l.\|a..k..z...{.5L.....V.=,.:w.......y...Z.X;Y6t..~6.....[.zuma..l..4..~h.....7l.^.tznq...\Z..i.......C.....{.viW.O.......%......V...6E.......Z.v......:.%.}...V.K.....[..i......[.......e.7...Nm^Dvc...:;..}

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	787
Entropy (8bit):	7.700206349602162
Encrypted:	false
SSDEEP:
MD5:	C5088E888C97AD440A61D247596F88E5
SHA1:	865A0D1BB7E1245E046C5E1BAE988CCE53330280
SHA-256:	D0CADF240E89340B93DF35240E7809039C1C574BE05FBE2CF3243E2F487BC9EC
SHA-512:	AE2A039FC7C2EC70AD33EEC78B3392D96D7899FB8BFFFCE45808C5D9E1AE6B3A73607B85D04433DE16DA43A8C007CB158E5D461302845EDD15CBA387D4B7E946
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/img/favicon/1x/favicon.png
Preview:	.PNG........IHDR................a....IDATx.\|SYHUQ.].Q....hZh...2Q.TB...2PC.#,-...?.>.....(DC.l0..h..>.$.AH2,.g>..sx...}..4....;..Y{.s!..N).3....<......k.:;:....X......A.:`ux]...C..4^...u~..U..1.c...i-<..`..2.s..&W..u\...l\c.6X...G..=X..nByL.7...OVn....RF=..0spaQo%..XD0..rC..i.e..o.`.9u..e.-.....N.H..S0..&h..A.@5#p15..'...2.....I=..........0P..l.S.T......y.&.Ks\|...h...!..W.BC.X.Q."...@[...b.34;.I.@.../........+.%.....k.........F..7%m../r.R.8.....W..]8....CR.:....d.J8...:......F.L.2..w.3%.....u..V.F.k...u.r...u.`gw9.F#.d=...B.0M...4.T.7-7IrM..{.v`.T.O.......DY.Aq5....../..P..n.jGa:..:.<...(+.K..$U.j..&w.n.P...wH.\...\|.....D00......-7...Q.TZ.4M.?...g..w.%"\....:^.z..<.....x.~[.B=...3............f...RJ..Q...d..1z.A7....(.........d.~t.e....IEND.B`.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 344 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	159255
Entropy (8bit):	7.994512362752919
Encrypted:	true
SSDEEP:
MD5:	67063D18D9FF7301D6E0B0486225AC50
SHA1:	50C8B36C6A5E7FEE4746C9E10379505787FAF6C5
SHA-256:	C8AB65A6497C1C9AA215BA4BDF8F9D7297DADD33F734B8CAC3A7ABE0A62722CC
SHA-512:	5E59BA4C2871735B8AA8C3C34FD7DEC042DC56E7DE49EF0F9302CBF83BB8721D0583171421AA9555D9E0850343063BB9ECB0701BAF74C36782BBEBDD952170B6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...X...........n.....pHYs.................sRGB.........gAMA......a...m.IDATx.t..-I.%.............P.BuU.t..&.l!... .?..@.>....._H..`.Bw.U...1G...g...t.`.Zp3o.3....LMu..).....[.\|qA..zK....(.-m..U!....F.!m.G..74....dBU=....}...:.._.o...h<.P."....B!....).?.......6.RKU.._.0......%.7..x-_#P..d.V.....qe~]...V..}..t...@.m.%m.-.fC.Dg.c..8..}..<:..g..\|z....GG......H1...~.../.[.1.p../..kZ.S.;.s...".6.@..q]<Q......:I~Y..Y.l.........@m.....x.Z.........%]W.=.8.....:.3........B........M#.......h.............=.79...a..Q..N4.....O.'?}I.........iA?.....[...v..7"k!...Xa....Tm...s.y_~yN..?.....\|.?..~x....6.%}...}..........{=$.=.b......o......=..3...GQ.;f......;..H7./.GY...Id1..!.GC.<\/...mq_.....2..ykI.?......gC...._..?{EqrB....r...._...Rtd..oy....X?..;Z....d{..j...v..X...._.l..}.C...{.Q.....}.Q..dK.u.......^.ZD.`y]...XP\..P....>......aE.YG.M.t2...c.l.......#=..\..[..n...a..v.b.l...ey..=]w..~zZ.....TM..X...i.?..XY.v.. ~_Q..Gi.

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15258)
Category:	downloaded
Size (bytes):	15341
Entropy (8bit):	5.375187890157731
Encrypted:	false
SSDEEP:
MD5:	03BB1FA54D9E3978FAD2A5F37BF2494E
SHA1:	E29743857F4C23C666D415A56C70247ECE981CC1
SHA-256:	873F512C3348DC6BB6407F4149406B309C25AB43FBF181F6F904818E0715D8EF
SHA-512:	2145CF01E5C89C9B20075E72BC33E9C24AEBA04A49CDF30D9E4EB69BC37A9B00376345395DF7451F450FDFEAC632C9666B4C25E763AECB2CD0949C1F52DFBD0B
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/runtime.aeb7bc814cb4cdda9651.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /(()=>{"use strict";var e,a,l,o,c,d,s,f={},t={};function n(e){var a=t[e];if(void 0!==a)return a.exports;var l=t[e]={id:e,loaded:!1,exports:{}};return f[e].call(l.exports,l,l.exports,n),l.loaded=!0,l.exports}n.m=f,n.amdO={},e=[],n.O=(a,l,o,c)=>{if(!l){var d=1/0;for(t=0;t<e.length;t++){for(var[l,o,c]=e[t],s=!0,f=0;f<l.length;f++)(!1&c\|\|d>=c)&&Object.keys(n.O).every((e=>n.O[e](l[f])))?l.splice(f--,1):(s=!1,c<d&&(d=c));s&&(e.splice(t--,1),a=o())}return a}c=c\|\|0;for(var t=e.length;t>0&&e[t-1][2]>c;t--)e[t]=e[t-1];e[t]=[l,o,c]},n.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return n.d(a,{a}),a},l=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,n.t=function(e,o){if(1&o&&(e=this(e)),8&o)return e;if("object"==typeof e&&e){if(4&o&&e.__esModule)return e;if(16&o&&"function"==typeof e.then)return e}var c=Object.create(null);n.r(c);var d={};a=a\|\|[null,l({}),l([]),l(l)];for(var s=2&o&&e;"object"==typeof s&&!~a.indexOf(s);s

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65475)
Category:	downloaded
Size (bytes):	3253213
Entropy (8bit):	5.8128794650195745
Encrypted:	false
SSDEEP:
MD5:	11C38A59D67AC79FAE4BD809C5A72839
SHA1:	2406C5813BC8F7392BB10E70A37D5C9691DD6351
SHA-256:	E8CFF547F055EAC2BD0680DC0666ED6E3D8506FD584B7D034A15F82D035B29E6
SHA-512:	2C4A75B87A50BC20D1E8FBA4AA456346B7F9CD603039F6B9795F99457C5E19738044997BECE351A56E6D1205CC064AEA70159094C483425975B91EDB9BD5DC88
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main.cb4af3d4b4e5c4e68d70.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[179],{292744:e=>{"use strict";e.exports=JSON.parse('{"v":"5.7.4","fr":29.9900054931641,"ip":0,"op":333.000060994453,"w":190,"h":120,"nm":"Comp 1","ddd":0,"assets":[],"layers":[{"ddd":0,"ind":1,"ty":4,"nm":"Graphic Outlines 3","sr":1,"ks":{"o":{"a":0,"k":100},"r":{"a":0,"k":0},"p":{"a":0,"k":[95,60,0]},"a":{"a":0,"k":[93,58,0]},"s":{"a":0,"k":[100,100,100]}},"ao":0,"hasMask":true,"masksProperties":[{"inv":false,"mode":"a","pt":{"a":0,"k":{"i":[[0,0],[0,0],[-19.412,-1.227],[-3.848,-0.447],[-24.798,4.416],[-6.722,4.072],[0,0],[0,0]],"o":[[0,0],[0,0],[10.548,0.667],[4.615,0.537],[15.816,-2.817],[3.841,-2.326],[0,0],[0,0]],"v":[[17.037,36.952],[13.568,101.171],[51.662,105.227],[76.735,112.498],[130.934,106.817],[177.896,98.49],[171.776,61.758],[166.995,46.289]],"c":true}},"o":{"a":0,"k":100},"x":{"a":0,"k":0},"nm":"Mask 1"}],"shapes":[{"ty":"gr"

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (8698)
Category:	downloaded
Size (bytes):	71642
Entropy (8bit):	5.470552548504202
Encrypted:	false
SSDEEP:
MD5:	E4A5E0D75361AE35FB3F3585FC104EB6
SHA1:	EBC8FFF8973BD4934F4539593ECB67B011BD5C43
SHA-256:	19620C206EA7EBB1F81836DC93A3CCF623D94754A091043D3852F9DE670197B4
SHA-512:	37B7A1F2F9F82D96324CFE5FFC8C52D53EF108716B91A4F01C5D8EE3CA06AA3586118903DCE075C3DD44B4989A375A55966D813EB72058282A9EB2E47515016C
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3iqES4/y9/l/en_US/Hi_BbD9AdoQ.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("QueryString",[],(function(a,b,c,d,e,f){function g(a){var b=[];Object.keys(a).sort().forEach(function(c){var d=a[c];if(d===void 0)return;if(d===null){b.push(c);return}b.push(encodeURIComponent(c)+"="+encodeURIComponent(String(d)))});return b.join("&")}function a(a,b){b===void 0&&(b=!1);var c={};if(a==="")return c;a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=",2),f=decodeURIComponent(e[0]);if(b&&Object.prototype.hasOwnProperty.call(c,f))throw new URIError("Duplicate key: "+f);c[f]=e.length===2?decodeURIComponent(e[1]):null}return c}function b(a,b){return a+(a.indexOf("?")!==-1?"&":"?")+(typeof b==="string"?b:g(b))}c={encode:g,decode:a,appendToUrl:b};f["default"]=c}),66);.__d("isAdsExcelAddinURI",[],(function(a,b,c,d,e,f){var g=new RegExp("(^\|\\.)fbaddins\\.com$","i"),h=["https"];function a(a){if(a.isEmpty()&&a.toString()!=="#")return!1;return!a.getDomain()&&!a.getProtocol()?!1:h.indexOf(a.getProtocol())!==-1&&g.test(a.getDomain())}f["default"]=a})

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 160 x 38, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	7.63976027729966
Encrypted:	false
SSDEEP:
MD5:	C4B5A3B429735F5BAEBAE24C265AA70B
SHA1:	7116B37D52C3562E71F1BAACA53F8676F65939BE
SHA-256:	2EF47EFE21BD38445E6D97A32ED9F20CF53B0D1B429E9B35FEC31188F60E2564
SHA-512:	88720D26601237196A6DA46F8AE9F2C84ECBB85BC3DFC68999C7F1B78405ECB20A6DB89CB8968BE41DD7E22EC19A7ACB0FBC9C14053A12C1BD7874C330650CDF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......&.....t.`....HPLTEGpL......................................................................z......tRNS...p@. `....P0....._o^......IDATx^.k.. .....t....e.d.fs.=...e.px...d..,.O...77\.\1U..p-....v)....6:.iS...F<.T.p.v........Dx...9..t...c.g......kjM..L....h(..xR..ZG.C..1w..^o#Xp..m!'....>n......J..:.....Z...........rl.Lz40"..\|..L.t.K..tQ.........X..!m..-..w....o.B..,9..,...'.B[...!.&..b<...\...7.YzEP=...."I.1._..G.)b...V..p.NML.n.m}...p+...2..OvW..Gv.5!..`.[.....Yy.U.......qu..\|..E...w.j.>.yV.e......+K...s.L)T....1{."... @.`i.'H..Y....rK...1k.j.....QB...{[.......4...........N .1..r)/...s.z.N.$.>..c.7......}.G2+...k.p.zd.......#..p...M....`......o..H.}~."y...AH....c..6B:^./..^8....0l3...pM.K....cA..<...&!.X...5d..T.......AB....I.){..V..0vj~.....U..".[...j...Jr...O.Q:(.......{s.....].C....:......2....2....c...3H..TU...(>I...^....m@.bq...J..8...W9,h..k.Y..H....."..Wy3db......S..Q..VhHZ...p>..-.m...<..sx.GN.....to.A.;.t...H..C....{

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5850)
Category:	downloaded
Size (bytes):	257384
Entropy (8bit):	5.416195316051054
Encrypted:	false
SSDEEP:
MD5:	50110CEB26D21CE9AA36CE945801617E
SHA1:	B1D315033A723FFC72CA3B9A39D789E2111862DC
SHA-256:	A6C975F4BB93C92605FC4863BF7108F8E90B0117E34719DD724D82EA83881573
SHA-512:	C7A2EAAEA5CAE64BAA14CA8C704ED9F2C5AD1366DD6D7AA422C4B14B65777D89FEF74AD2B4F37276055856DA539D3F7A11D149DD3F14030FA043D75F9F628DFC
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3iM3l4/yB/l/en_US/HP23cDL00Ta.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("AboutFBGATracker",["$InternalEnum"],(function(a,b,c,d,e,f){a=b("$InternalEnum")({ABOUT_FB_CAMPAIGN:"aboutFBCampaignTracker",DEFAULT:"default"});c=a;f["default"]=c}),66);.__d("AboutFBGoogleAnalytics",["$InternalEnum","FBLogger","URI"],(function(a,b,c,d,e,f,g){"use strict";var h="about_fb",i="send",j=b("$InternalEnum")({Click:"a1",Open:"a2",Close:"a3",Play:"a4",Pause:"a5",Visible:"a6",Toggle:"a7",Clear:"a8",Filter:"a9",Previous:"a10",Next:"a11",Drag:"a12"});function a(a){a.fields=q(a);l(a);try{if(window&&window.__ga){var b=a.trackers;if(b!=null&&b.size>0){b==null?void 0:b.forEach(function(b){return k(a,b)});return}k(a)}}catch(a){c("FBLogger")(h).catching(a).warn("Failed to send GA event.")}}function k(a,b){b===void 0&&(b=null),window.__ga(u(b),"pageview",a.fields?Object.fromEntries(a.fields):null)}function l(a){var b=JSON.stringify(a,o);a=a.trackers;if(a!=null&&a.size>0){a=JSON.stringify(Array.from(a));c("FBLogger")(h).info("event: "+b+", pageTrackers: "+a)}else c

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (10442)
Category:	downloaded
Size (bytes):	11721
Entropy (8bit):	5.2929951510286255
Encrypted:	false
SSDEEP:
MD5:	4F17BFC210DBE414E63FCA0B09FCA535
SHA1:	F64F41C1EFCDC69819A3E13CD615786D1D9EE61D
SHA-256:	C7682E20CA6F2796D2ACCBCEED0865CF3305943BBD0BF886FC5E38DFAC27AC9B
SHA-512:	B64EDA8D2267EFB87EC0DA7687A0C09CF1A157ADAD9149E6A38B38DD51196B3B5144A0D634FC30B89AC9030E3EADF41E30B09BD3A4012F033B796C106FBB3DD0
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yM/r/PPmDVJ1x5cT.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("getElementText",["isElementNode","isTextNode"],(function(a,b,c,d,e,f,g){var h=null;function a(a){if(c("isTextNode")(a))return a.data;else if(c("isElementNode")(a)){if(h===null){var b=document.createElement("div");h=b.textContent!=null?"textContent":"innerText"}return a[h]}else return""}g["default"]=a}),98);.__d("getOrCreateDOMID",["uniqueID"],(function(a,b,c,d,e,f,g){function a(a){a.id\|\|(a.id=c("uniqueID")());return a.id}g["default"]=a}),98);.__d("CometLruCache",["recoverableViolation"],(function(a,b,c,d,e,f,g){"use strict";var h=function(){function a(a){this.$1=a,a<=0&&c("recoverableViolation")("CometLruCache: Unable to create instance of cache with zero or negative capacity.","CometLruCache"),this.$2=new Map()}var b=a.prototype;b.set=function(a,b){this.$2["delete"](a);this.$2.set(a,b);if(this.$2.size>this.$1){a=this.$2.keys().next();a.done\|\|this.$2["delete"](a.value)}};b.get=function(a){var b=this.$2.get(a);b!=null&&(this.$2["delete"](a),this.$2.set(a,b));retu

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 344 x 256, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	184486
Entropy (8bit):	7.99487465555235
Encrypted:	true
SSDEEP:
MD5:	C359BE30DC34CF40A560CB5EE63A268D
SHA1:	54442163E3987CF5DAF0AE6A8CF296A74CF1FEFB
SHA-256:	D8F7B5CB8E53355E6195CDF17A7A2144059F79F5AB369CA029AE0162979CE6A5
SHA-512:	8AB59F8E550AF2D9CAC4ED7F3B5AE6FFF8EDA3D83CA0A98F3646B8FE89D77DC91E34309F49B3451C5A185C64C76484B999500D528FAD77A0AE6459A582932655
Malicious:	false
Reputation:	low
URL:	https://scontent.whatsapp.net/v/t39.8562-34/313895820_796224518112924_6447006880336076068_n.png?ccb=1-7&_nc_sid=2fbf2a&_nc_ohc=LcOptQmQcK0AX9txeWv&_nc_ht=scontent.whatsapp.net&oh=01_AdQtpx7Xll00d_Gu0tsch9PzapDCIBuDAzkGh2AIMCPl7w&oe=641ED097
Preview:	.PNG........IHDR...X...........n.....pHYs.................sRGB.........gAMA......a....;IDATx.l.g.%Y......W..:#UU..~..T.$....8 Gr..l......1cc6_iF3.A3........Y.:2t....g.....0..22.^..G..........O.3.Nr..E.K.._.Y.l..,.e..L.\..y...[.gK}..?..%.....Lr...L..7.....'....7.....G....}............^...2...J.$.W........]...1\|....r.!.s.{.g..i.....Q...uxX^c..O.9..c..Z.s...g.=.>......l.~xf..E6.....].`.3...d...r}A.....{\$...D6.%.,.r.\.~.x.....?..zI~.'?.'.E.L\|o.O..5w....Nz........".;.Y>_........D...q.b.$xM{.)a.#.n].q9...J%.E.".z]..........\...V.f5.a.c.kv.%..,...Sn....Y.3..j...Me1Z..+..R$..f...c...D.[%i..Rk&..)...U../.%1.AMF7'...@..?...\...t.G...d>.K..%.+.u.RjoKk...jk.0G.iO..$y.u..z..!..Pf...!..o..W............?..\~8.`.a.c..<g.........s..,e....O%..ok%.Y=...L.....\..S.....~.u...;...^..w.t.)...$..\O...c.....TC".zU..L......Y.$./..t)..}].e.u..zor?cm.ge.....-U.....)XG!p/q.....&.+.3..._\7.....F).F...v]B.XJ..`.v%T.RiV...T..N.{.{...K..D.....f#.g....!.kt.y.

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 646 x 250, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4904
Entropy (8bit):	7.899029446643728
Encrypted:	false
SSDEEP:
MD5:	1E91D02CF5A902F38F2923C006D79281
SHA1:	CB8126B32C2274E0394246B40BD0B7F9F847E44C
SHA-256:	F72611E2DF8E88204009FD896D05D5E8E83C77009C63943BBFFA169559934849
SHA-512:	54B69544DC55ADDC0B2DDC08418D1A0A34240697070FE47FEAE9E915C70D33EF662CE1B7154CBCAD84019D22F3291F138CC7298224D381CC740C2097478D4042
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............+v.....PLTEGpLWWW^^^fffnnnaaaxxx.........sss\\\.........hhhIII**.........sss...444}}}...>>>SSSYYYjjj...}}}^^^ @@@ppp......```000PPP....J$._/'~>$t9.T.5..........................................D4.S1.N....................... ...I..kkk..................zzz....?.......!i4...$]c....2d.:.....:u.B..=.....8.N..nS.:.N.......?/.;.N......=.N~^......^G.?.N....v.@.NO;..j...............<.T/#.5.\..7L...xK.OY.C5.q#.n!.2(9...;/I...?2u"..!...;..X....%...K..7+I..g...&.,..H..G..E..FFu..a.... tRNS.:..........................j...N}......IDATx...Ub.@.E..I71.0.....C.5.............................?...._.r..[........E...v^Ne...E;+..l..n..c...]w..\|r...m>.w=...2..5.+......tW..].........6m.i..).Y.h.B.k....j.......T.l.\.<...T.H2.._...a.....u...e.}.Op...J.....I.j.....>.C...&.tW.T0Kr..I..4.v.].OrSie..!O.......!......!.g..Z.0......r..\|4.h.t..{.............N...fi..-R....LH9#....7I$..$..o.T....8......@A<y..s....K...%Wt.y.z..].i.h...T..l.E6.....S7C

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 344 x 256, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	212285
Entropy (8bit):	7.994347894692688
Encrypted:	true
SSDEEP:
MD5:	92DA0EADE431F1A0F601F070C398679E
SHA1:	0318FD1BB4D2A9A9B34C972D83DB9F8922C6464E
SHA-256:	A674B7A51A2C77F1F3CDD019FE298C51BD58E43F4C8584768904A0C65E341B24
SHA-512:	BDC1802CBB0C61E8688522ADA4EF469AAA8D9A27517B7660E9403FB1F700BBEB4DE4D388B3BD624F33C7341BE796590A40195BBC574FFE151EEBE1D4B128D513
Malicious:	false
Reputation:	low
URL:	https://scontent.whatsapp.net/v/t39.8562-34/313421771_662760865227418_1457196189222420488_n.png?ccb=1-7&_nc_sid=2fbf2a&_nc_ohc=DiKVWtCoeXQAX_KpMai&_nc_ht=scontent.whatsapp.net&oh=01_AdR6W0y4CHmOwIkDrZADBrF_mJMKG7NupC7YMj5n8hT0Xg&oe=641EDD0C
Preview:	.PNG........IHDR...X...........n.....pHYs.................sRGB.........gAMA......a...<.IDATx...Y.eiv...3..^.#<....2.0.@....$.R7.%.L......"3...~..d-kI-....n......".U......<\|..p.^k}.GV.$....;...p.~.9.....^{.;..j.?.gu].............}...?...[./_...y.^... ............}.Sm..Z..V..'.N...V..m.]...I..M:......:.....J.Q..y~..--.qmuhI...........BJ+p.~..e................p/.k.......O.Od-\.~..-......ze..Y..N.+J..--."...;.t?\,.r.....3,.......8...:X...vkU..%X........7....{.Xm,yia..=b.....[..o......m.<......?y...G?.eUX'.k..b\.....Z..Z.]d......UVX.^......~.7..W..g....o....g?2?.....p..<x..z.].w........O.O~l'..uF]....h...:..G...p_...ie.....Z..+...6xn!.k.{...Hk..O...../....:.g+<.*_a...wB..~.Z.5.)mG.........M;o...s...[.F.;6..J,~.[..):...o..kl[..0.Zo4..^bI+..N.......k........v.s.}q<).........mY..Gb....q.K....m1..lz..S[7.....1.e3....s.a...}..W........<'s[?...?.....-.3..3..cy...e....6...5.....S.T.l.Y.k...z8h.,..xj..eEQ....yuh.n.Xk=.....,S...}..{pQ.....z[.

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (327)
Category:	downloaded
Size (bytes):	507
Entropy (8bit):	5.35758988661724
Encrypted:	false
SSDEEP:
MD5:	759DF6E181340EF0A76A1BAB457EBB22
SHA1:	2AFDFA1808428E97F7F8FAEA0624C8402956B04E
SHA-256:	9E57FEDB96B3686621BCCD5521F43A2037A823C74F062176952890B179B3955B
SHA-512:	2E20C1B3B445DD0B143DC636EAC9421454B1615A6CE0BE63AFA012E7571385F346F456B9FF25545FD90AE11DD08B23F03F36F2242C817855D26578FC9F5C94BA
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/../*. License: https://www.facebook.com/legal/license/V9vdYColc4k/. */.__d("react-0.0.0",["React"],(function(a,b,c,d,e,f){"use strict";function a(a){return a&&typeof a==="object"&&"default"in a?a["default"]:a}var g=a(b("React"));d={};var h={exports:d};function i(){h.exports=g}var j=!1;function k(){j\|\|(j=!0,i());return h.exports}function c(a){switch(a){case void 0:return k()}}e.exports=c}),null);.__d("react",["react-0.0.0"],(function(a,b,c,d,e,f){e.exports=b("react-0.0.0")()}),null);

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	643
Entropy (8bit):	7.1594140456292195
Encrypted:	false
SSDEEP:
MD5:	4A25BE0C95D280005EA78D83FB18B922
SHA1:	C70CD9F970418ACB075D497D45FD7001B0D0FEDD
SHA-256:	79ADDAFADD1DCEE91EC75407A2142D016B25028526301C4865578575BE178659
SHA-512:	6813E1AFB96716CFCCE1A2071CE3E464E090242FA3D9CB17D69383A66C8034F9D550C94E7ED25052F2A4EA4DA5C764BCFCD8FEFB694A1763FC874A4466BA385F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....D.......PLTEGpL(.`%.g .p .`%.e%.e%.f%.g%.f&.f .` .h%.e%.g%.e .`%.f%.e(.d$.d%.e&.f%.f(.h'.d'.f#.f%.e&.f&.f%.g%.f#.e%.f$.f$.f%.f%.e%.f&.f.j#.g&.f$.f%.f'.f&.f&.e.e%.f.......2tRNS. ...`.... ....@@0.. ppP`.P...p.0..0....p..0..k...gIDATx^m..0....J.MP...q.}...pCN.........\hDm.}...,..-AY`$..\|p......'..s9-...v.....9.....CN...Q..\|D.........}2..cP.....<....q.\|J#\|tY...4R..J.I.E-..a..(.X...+.../.r... ..g.M.41..7...!}..S..n..........p.....C?..........d..!...h.-..5.J~Tv..X.Lw'.t.".d..:....l.......q.X'......}..d..DE..f#ZW.}U..J..5z......UD....].'.x..\.)....,.c..D$D..L.._...i.8.o.......IEND.B`.

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (937)
Category:	downloaded
Size (bytes):	167788
Entropy (8bit):	5.323387359850595
Encrypted:	false
SSDEEP:
MD5:	AB151ADEDC0DF0A737D94628847A11C1
SHA1:	5060037AB0C4D8A357A70F8D6A010A4B889DFECF
SHA-256:	DF2B4689C50C9E9E54EE05019E425BCA49EB8690A8BC73E197DE875C9BB34C98
SHA-512:	30A21B98904DCBBE0EC43CF3595764A576BD555DC06DCDA6DF1BB296F0302E2CDFD267E944428B8ABFDA4FC535A66387863FFE0D9DFCF2F710A7D99A60A834AD
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/stylex-5ca894150e39e3bf05c3ff16d6419c5a.css
Preview:	.a1m9qzja{flex:1}..aja0x350{text-decoration:none}..ajuzgosp{transform:translateX(50%)}..amxrrayi{transform:scale(.97)}..b4a78re4{transform:rotate(135deg)}..b4xm8rjh{transform:scale(1)}..b5bqnu92{transform:translateY(-240%)}..bglikw2g{transform:scale(.01)}..bj62907l{transition:none}..bnt9nn9b{transform:translate(5px)}..bqte3on1{transform:translateX(-1px)}..btgdcgtm{transform:translateX(-100%) translateY(-50%)}..bwjm0vhl{transform:rotate(-90deg)}..bxpi4b5r{transform:translate3d(0,0,0)}..byw3xhqn{transition:opacity .3s var(--t-ease),transform .3s var(--t-ease)}..c5h0bzs2{transition:opacity .08s linear}..cgi16xlc{transform:translateZ(0)}..cljgexa3{transform:translateY(6px)}..csshhazd{transition:opacity .15s ease-out}..cxnvdhix{transform:translateX(1px)}..d4g41f7d{transition:opacity .2s ease-in-out}..d7dzraxg{transform:translateX(2px)}..d9ddx5tg{background:linear-gradient(to top,rgba(var(--overlay-rgb),.5),rgba(var(--overlay-rgb),0))}..e3l9pkzr{background:var(--video-player-background)}..e9

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65453)
Category:	downloaded
Size (bytes):	181993
Entropy (8bit):	5.2817221649376895
Encrypted:	false
SSDEEP:
MD5:	1041B48074504AE34D1E31FED3724719
SHA1:	ED60F3A981837D133FBE7BAD4136E8461A17DAF5
SHA-256:	3ED40560848464DFF4C6EAB27735866D8E8E736C346976129B5939BE41E80A43
SHA-512:	5364974E03886B6AB2860A77D9EFE46A56993EB10E3C55DFC168B7B70A87A36C6AA335C40AEF0B199E07484EDBFB2FED4491D7226935C84AF8A422491250E54A
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/vendors~main.bfc632c7e596260920d9.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[9821],{986907:(e,t,n)=>{"use strict";const r=n(471313);e.exports=r},471313:(e,t,n)=>{"use strict";var r=n(587592),i=n(244783),o=n(389408),l=n(376969),s=n(932998);function a(e){throw Error(`Minified Lexical error #${e}; visit https://lexical.dev/docs/error?code=${e} for the full message or use the non-minified dev environment for full errors and additional helpful warnings.`)}function u(e){let t=s.$getSelection();if(null==t)throw Error("Expected valid LexicalSelection");return s.$isRangeSelection(t)&&t.isCollapsed()\|\|0===t.getNodes().length?"":r.$generateHtmlFromNodes(e,t)}function c(e){let t=s.$getSelection();if(null==t)throw Error("Expected valid LexicalSelection");return s.$isRangeSelection(t)&&t.isCollapsed()\|\|0===t.getNodes().length?null:JSON.stringify(h(e,t))}function d(e,t,n){(s.DEPRECATED_$isGridSelection(n)\|\|null!==l.$findMatchingPa

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6000)
Category:	downloaded
Size (bytes):	10259
Entropy (8bit):	5.553042137909154
Encrypted:	false
SSDEEP:
MD5:	DF54560FB6BC692B147A0D81256B03ED
SHA1:	75F39F2C9AAF8DEF0A012D0DE2573A05CDDA6EA1
SHA-256:	E309025A5B784E27E20E9729A432E81955D5276269261BF690AA988FFA5D3B41
SHA-512:	7E050E8D36CCA180C90A26104D565D9BD6311EF2857C659B97755967617948030BAAE14AF403C69F8FFDF9A3AAF842180953CDEBD407E474B018B54F6F45AC67
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/send/?phone=447493588242&text&type=phone_number&app_absent=0
Preview:	<!DOCTYPE html><html class="no-js" dir="ltr" loc="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><title>WhatsApp Web</title><meta name="viewport" content="width=device-width"><meta name="google" content="notranslate"><meta name="format-detection" content="telephone=no"><meta name="description" content="Quickly send and receive WhatsApp messages right from your computer."><meta name="og:description" content="Quickly send and receive WhatsApp messages right from your computer."><meta name="og:url" content="https://web.whatsapp.com/"><meta name="og:title" content="WhatsApp Web"><meta name="og:image" content="https://static.facebook.com/images/whatsapp/www/whatsapp-promo.png"><link id="favicon" rel="shortcut icon" href="/img/favicon/1x/favicon.png" type="image/png"><link rel="apple-touch-icon" sizes="194x194" href="/apple-touch-icon.png" type="image/png"><meta name="theme-color" content="#111b21" media="(prefers-color-scheme: dark)"><meta name

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18471)
Category:	downloaded
Size (bytes):	190156
Entropy (8bit):	5.553220464319725
Encrypted:	false
SSDEEP:
MD5:	E43BA5606030955B77E161CC130A5308
SHA1:	9DF53E0FD8251E7FC1BB0044BD3CEA68F7EE2A19
SHA-256:	6B75AEFBC362548FDE42BD23380EF1043A7D489EC2F9549A82F49A09043074C7
SHA-512:	21E567AE0042CECDC6EC3C7948FC4CBD55E0E31DC367D79005401D942F33329B0984F2126B45137D3645EA3F867FF7D441812DC49D4502F81CB99FD58F667FA4
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/main.6ecc7c3af8c7d1fe0eca.css
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /..sU45s{position:absolute;z-index:1000;display:flex;align-items:center;justify-content:center;width:100%;height:100%}html[dir] .sU45s{text-align:center;cursor:pointer}._2Z8rO{width:50px;height:50px;line-height:50px;color:var(--inverse)}html[dir] ._2Z8rO{padding:35px;margin:0 auto 35px;text-align:center;border-radius:50%}._1ab4u{line-height:normal}html[dir] ._1ab4u{margin:0 20px}html[dir] .sU45s ._2Z8rO{background-color:rgba(var(--teal-rgb),.6)}.sU45s ._1ab4u{color:var(--teal)}._2Z8rO svg{width:50px;height:50px}.._2XdMx{display:flex;align-items:center}._1sPvB{color:var(--panel-header-icon)}._3qNGb{color:var(--icon-strong)}._37e4A{color:var(--inverse)}.rOo0o>._3ndVb{height:24px;width:24px;display:flex;justify-content:center;align-items:center}._2XdMx>span{display:flex;align-items:center}._3OtEr{position:relative;flex:none;height:100%;transition:background-color .3s ease}html[dir] ._3OtEr{border-radius:50%}html[dir=ltr] ._3OtEr{m

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1587
Entropy (8bit):	4.621475826394845
Encrypted:	false
SSDEEP:
MD5:	7BB7990889296FAE93DDA06259270540
SHA1:	6A5586358C1AA446680E151AC182063DFE1BC2C4
SHA-256:	CF597AD08FD08E692A793C5EE61CED5C689007361AD3F6BAC1C506E8CD0270E3
SHA-512:	0C7702AE9BD58EC26DFC1BB883F361C9E98010AF18FE0825FCAF2E766639834589BA3CB36822AE4B035DD891AEF4A637AFCC629E89926360E89EC5CD2F0AA7A1
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/manifest.json
Preview:	{. "name": "WhatsApp Web",. "short_name": "WhatsApp Web",. "start_url": ".",. "display": "standalone",. "background_color": "#f0f2f5",. "theme_color": "#f0f2f5",. "description": "Quickly send and receive WhatsApp messages right from your computer.",. "icons": [. {. "src": "./whatsapp_pwa_icon_16.png",. "sizes": "16x16",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_32.png",. "sizes": "32x32",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_60.png",. "sizes": "60x60",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_64.png",. "sizes": "64x64",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_90.png",. "sizes": "90x90",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_128.png",. "sizes": "128x128",. "type": "image/png". },. {. "src": "./whatsapp_pwa_icon_192.png",. "sizes": "192x192",. "type": "

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 560 x 315, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	16259
Entropy (8bit):	7.968675746259537
Encrypted:	false
SSDEEP:
MD5:	0C6EC69B054FDEB31CF3E5E10290FD8E
SHA1:	5B2D2EF0E3B5824ADDCC34D642769F5F14671411
SHA-256:	D980AB372658F4C7C8F07D730EF6DC67E3FB3471F37928274F915C0308850994
SHA-512:	61947EEFDEFDC94654991E00DE1045CA1E781B69FE1C7305614735926E256F007368F3E904207C8612E03D09E904E03B2A69A4CB297672A49952B2DDA5459CA1
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/img/qr-video_0c6ec69b054fdeb31cf3e5e10290fd8e.png
Preview:	.PNG........IHDR...0...;.......K....$zTXtCreator....sL.OJUpL+I-RpMKKM.)..Az..jz......pHYs.........O%......PLTE...222..~.....................111...3339;?....% ...344<>B;=A./0......78<......000OPRwwwtyzggi;;<CEG......]^a...him%&'.....................')+.......#............~~....555.........>>>SSS...ABE.........888...+.FGK...eeg..._`c......??C.....abe...W..XY\...............???UVZPQU...LMQ............[[^.. JKNu{\|559...mnq..........klo........~.........stv... !#...TUW...\|\|}......ppt..........'.............."#&.........................ist......{......b[QTWkxy.....::=........................^ij.......................ITUw........,67!-.0;<bno...Yde...&12...a..^........ ..P[\.&'............T`a.....DNOn\|}6FG......;........>JKL.....~..6ABb..C.....+........=.~?QS......m....[.....C.p.....3..YR........}_.nN.]J...)%~.......v..6rk.....B.U5.Ij........2~2..[..,..;.IDATx...O....!.3........V\_..j.s..).....8.(8g..B..J...T....R.........V..t..f.(.Nr$....T.R$....'/....RJBx>~.."c

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3566 x 830, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	29465
Entropy (8bit):	7.8573324538118525
Encrypted:	false
SSDEEP:
MD5:	6BD7AAD7D4B0DC00D4ADFDF6F0CBF399
SHA1:	3445447C81CE085CBF3165822DA472156A1949ED
SHA-256:	0DBCD72A5BCFD55A91EAFA6C362C67E1D434016FC85308E17F99AF100565BE0B
SHA-512:	8DB874A322B65BA06D7BE3B41BF469CBCE7FBE496666D077E6FE02DEA079C2EA4C9A653EAA7CA48F5BF360BE1F1ED4B80AD8FCF94697D497BB59B6F710E7B28C
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/y7/r/DSxOAUB0raA.png
Preview:	.PNG........IHDR.......>......r.....3PLTEGpL%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.f%.foS.+....tRNS... ..`.@.0.pP.X..Z..r.IDATx^..Y..7..P..$.#...v.O.B..V....9...."N.._[.p._8..e.......r.k.}.#...#...n........T_....~........-....>...R..Z.w.k."....0....^u.../...@..z..w.S.>....=...X.4......y:j;.zLC.;.......U.5.)~....y.v=K.w......\.v]......%.v.5......Q..)......0o...g.[......ni...{<......v..6.s.......?.x....4.c{...........gZ......0l}.^......'.....z....@.~.z.{\.......0v%.....tc.5.c.+......~..zg\|...Sm..K-u.....z..%.......85u..............s....0..9.3.u.....}...~..........Y.....>Tg.....]..9.....N...!.......5..#..@?.......LK.Z.\|.........@.......=...........a.......XJ\|....}iw.-...@..s.....P.....B...C..#.....<..`.)^...`........P.v7J:............. .vV........>.......v... ..=........8.....8............P.v-,{.......s..u..@E.......`..C.....6..#.....F{.?.d.....v..........\|....=.....W{}..b.w9.....Rk.9o./s.V..s>j.w...........R...R..k].....`....R.....o......t....<.._

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 344 x 256, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	190115
Entropy (8bit):	7.996513178164085
Encrypted:	true
SSDEEP:
MD5:	BA46034DAF2B6AF52E9D1EEE181B8FF6
SHA1:	9552C50215A60FDAA43E2C54622B53370DEDD5E9
SHA-256:	D787C4EE0AAEFD6FFE63FD1A619C2EA61AFFA1FF116F76D2205EB611A1290847
SHA-512:	BB48D4A327EC3D821BF79B47E304D097FBD720D6E76C14919A527521EC7C20E44DB630866618B6608519DE840069A47A6987FDEE39B1411FF70211350C263A38
Malicious:	false
Reputation:	low
URL:	https://scontent.whatsapp.net/v/t39.8562-34/313927892_1114976369411453_6283310676130032127_n.png?ccb=1-7&_nc_sid=2fbf2a&_nc_ohc=Qx58B1bQ-ncAX940BP3&_nc_ht=scontent.whatsapp.net&oh=01_AdSWTTr1s1FE2W327CBRYKn1cbOHpOz8mi6BoKURmKzDbw&oe=641EB469
Preview:	.PNG........IHDR...X...........n.....pHYs.................sRGB.........gAMA......a....8IDATx.T.g.e.u...c.{6^..t@&....%R%UIU]=.S.....GW..VI..A. .&.&2.g.?n..s.... .....}.^f....^^-Snf)3..f........?I...f...................R.......z[...(>wH..6.5.>..............r7$~.w.u.;._@..~...6.o......._.guQ.g$......_.y."/...w.{.3...l.n..........V.k..\s......Z.w.}..s...ik..[.6.z..?;.:T........g.....,.}.~..eCn.....k....tg..e(....j:..8...k..K.....[...t~...(.....9X.k..7+_...k+g..~}..-..K_.>.z.6..U.S.....v}i...?)..........xi.].Zml...]......}.{?.....[.,x...g.z.{......o\|....._..Z.:k.;.o.~.{.;...;...~...bo.?.G.NlV.ly...fk.f..L.mv.....o.5.m.Y.?...g...m;,.M...sj3...C...9..m.Y....x.m.5..............{............k/...D..........v..&V...G...}.......(..r?.\..........>..?.......yfu..Pf6.......Ll:.g;.....=~u....(*....2......L....M~..+../..}..\..;;~...O..........:......3..>p.r..f@......x.x-^....\..l...!....v&.~=ee...o..}..+k7;.g.v....\C&[6.<.<C)..R.O._.#..k....,..........1..

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65475)
Category:	downloaded
Size (bytes):	4706979
Entropy (8bit):	5.617702615656016
Encrypted:	false
SSDEEP:
MD5:	A828A6E4F821E55035BC45796EEBC8ED
SHA1:	7244F63FC70B61414486A2874AA6216E5E80C8CC
SHA-256:	63C74908DB8EB9F49853438CE4088EEA2B10B63AC557BF7EFCB59033B1C28160
SHA-512:	BD345DBB3274AADDD5406A4E9DE3FAB061CA456EC9EA6A9B69C4326D6F03DC769B36ED2336B42D841C81FA5C3F4C0A5834BBF56E811BA8833789758259AAE765
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/app.39064ec0dec361638b30.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[2143],{363509:(e,t,r)=>{var n={"./f00.png":192256,"./f01.png":107151,"./f02.png":329449,"./f03.png":594719,"./f04.png":783004,"./f05.png":99381,"./f06.png":604893,"./f07.png":761353,"./f08.png":945598,"./f09.png":379575,"./f10.png":105211,"./f11.png":419751,"./f12.png":61294,"./f13.png":970938,"./f14.png":381790,"./f15.png":8669,"./f16.png":130047,"./f17.png":361022,"./f18.png":633295,"./f19.png":299635,"./f20.png":882645,"./f21.png":367083,"./f22.png":755359,"./f23.png":30003,"./f24.png":677659,"./f25.png":81024,"./f26.png":564195,"./f27.png":837704,"./f28.png":393374,"./f29.png":712282,"./f30.png":657894,"./f31.png":353320,"./f32.png":918234,"./f33.png":537426,"./f34.png":37382,"./f35.png":380904,"./f36.png":605193,"./f37.png":838324,"./f38.png":683149,"./f39.png":968480,"./f40.png":235741,"./f41.png":424081,"./f42.png":709062,"./f43.png"

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4488)
Category:	downloaded
Size (bytes):	12374
Entropy (8bit):	5.295067831510249
Encrypted:	false
SSDEEP:
MD5:	179E6E51E81D33A006763D9510C206F0
SHA1:	E82E7F1494D28DA094052CE4710E0FAEF499171C
SHA-256:	FAF678C19CB21AADEB4DC603D9F59AE337EAEB16AB6132985CACAB5B04DBA5FA
SHA-512:	45461AA9E85473E68F07E00CDB345F45013310A68A91554D4625418BA80B3390E4B2FFEC6598E4C9BB69603268DD586DD8E5F0C1B45A9A0F4A067786D889170F
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/y2/r/kqEztWyhnlh.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("FocusEvent",["Event","Run","ge","getOrCreateDOMID"],(function(a,b,c,d,e,f,g){"use strict";var h={},i=!1;function j(a,b){if(h[a]){b=h[a].indexOf(b);b>=0&&h[a].splice(b,1);h[a].length===0&&delete h[a]}}function k(a){var b=a.getTarget();if(h[b.id]&&h[b.id].length>0){var c=a.type==="focusin"\|\|a.type==="focus";h[b.id].forEach(function(a){a(c)})}}function l(){if(i)return;c("Event").listen(document.documentElement,"focusout",k);c("Event").listen(document.documentElement,"focusin",k);i=!0}function a(a,b,e){l();var f=c("getOrCreateDOMID")(a);h[f]\|\|(h[f]=[]);h[f].push(b);var g=!1;function i(){g\|\|(j(f,b),k&&(k.remove(),k=null),g=!0)}var k=(e==null?void 0:e.runtime_site_is_comet)!==!0?d("Run").onLeave(function(){c("ge")(f)\|\|i()}):null;return{remove:function(){i()}}}g.listen=a}),98);.__d("KeyStatus",["Event","ExecutionEnvironment"],(function(a,b,c,d,e,f,g){var h=null,i=null;function j(){i\|\|(i=c("Event").listen(window,"blur",function(){h=null,k()}))}function k(){i&&(i.remove(

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (505)
Category:	downloaded
Size (bytes):	566
Entropy (8bit):	5.342370089186833
Encrypted:	false
SSDEEP:
MD5:	F97EC5EF757BE966E78DE7957A24789D
SHA1:	08F22F4D0C1C14E5576FF26D445CE35FAB234CEB
SHA-256:	BA269864BF5C844194B6C9393F03FECC51FF891897DF5B5E03DB59481A5E195E
SHA-512:	053DF374173A206CA38B9254F71CF1BD96CBF10133363E32AF57E359BF4C987973BB978790AFB068F36BF6BEB24FCCC41FC428BFB19BEF3632A64B1F868C39FB
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/locales/en.3087636934407f68b5b1.js
Preview:	/! Copyright (c) 2023 WhatsApp Inc. All Rights Reserved. /.(self.webpackChunkwhatsapp_web_client=self.webpackChunkwhatsapp_web_client\|\|[]).push([[6933],{80610:(e,n,t)=>{"use strict";var u=t(595318);Object.defineProperty(n,"__esModule",{value:!0}),n.default=function(){return f.apply(this,arguments)};var l=u(t(348926)),s=u(t(138097));function a(){return"undefined"==typeof fetch?null:fetch("/emoji_suggestions/en.json?v=2.2312.7").then((e=>e.json()))}function f(){return(f=(0,l.default)((function*(){return[s.default,null,yield a()]}))).apply(this,arguments)}}}]);

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3566 x 830, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	29526
Entropy (8bit):	7.868689249946656
Encrypted:	false
SSDEEP:
MD5:	215698B8F763CE612C41964F0F14E507
SHA1:	226059CD8896A857DCA6437F29F58E9F682E4D00
SHA-256:	2FE76A197D3891F7848604C87A945231C4DD2E39A74BDAED45AC5648A0DD72E2
SHA-512:	3DE592395D0D81E928E465A188F58BAF28F4A043C65A651421122C266355471B602C3141D0BF54FD537B78FCDC07A9D618915B6D95A61B4B853418B9DCF6067C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......>......r.....3PLTEGpL.................................................A.*....tRNS... ..`.@.0..Pp6.4_..r.IDATx^..Yv..@Qp..p..Wk.m..k......{....N....X...H..._.........!...{l).........5/..4..5.T......Xs))...bJ.\|~......2.X...O.>....\|.i./5....1.....bm.......`...k..p..........7.....\|.c..m_..K...L....G.....X.a.7..s......zG.....\|...L.7..C......a..J...... ...+.......`^.X...5<....Z...qx......s......b.....!.G.......^........7]\|...Z.N......S\|....Z...'.....2V~z./........+...z...x..v.G.....5...8.......P...5......{.=....X..._....,[}?b..:.........G....,............2.......X;cO'...\b.p..^...`...`[B.............~.b.C.................{....@..>....'.....T?.....pg.x.....@.9....0.X_.1.....p...R.......k3...#..............N....Z.l...X..(......`M.7>.......6..~.....k.Hk......'.........N...s.......`:..P......b......Vo.a.?...P.]...c...y.7.1....../...%....=.d.....0......0....,...76........K).3.....7.MJ)..s............`..!mn......R..-...s.X9.r.....h....o;.+W..

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2605)
Category:	downloaded
Size (bytes):	2818
Entropy (8bit):	5.307759751583872
Encrypted:	false
SSDEEP:
MD5:	A3EBD7C55E737EF3A0F01A98FB02379B
SHA1:	7E3D276F436D98F1F85EA59E94CFD8C4B91590AE
SHA-256:	0DB0F25E050A0D52BEA0D34475A85A10E6B23B1A1A56E21BED8DBE86EB5B3FC2
SHA-512:	760499379126B335A4277DAF5FBFC57BFE9E58A788DCB19DCAD286C9C03F650018D1A9DBBB8408B03C26C9759E6021EBBFC88B527EFABF42E2851016699DBF90
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/ya/r/ZL1A46FYUm6.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/../*. License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. */.__d("body-scroll-lock-3.1.5",[],(function(a,b,c,d,e,f){"use strict";var g={},h={exports:g},i;function j(){!function(a,b){if("function"==typeof i&&i.amd)i(["exports"],b);else if("undefined"!=typeof g)b(g);else{var c={};b(c),a.bodyScrollLock=c}}(this,function(a){Object.defineProperty(a,"__esModule",{value:!0});var b=!1;if("undefined"!=typeof window){var c={get passive(){b=!0}};window.addEventListener("testPassive",null,c),window.removeEventListener("testPassive",null,c)}function d(a){return i.some(function(b){return!(!b.options.allowTouchMove\|\|!b.options.allowTouchMove(a))})}function e(a){a=a\|\|window.event;return!!d(a.target)\|\|1<a.touches.length\|\|(a.preventDefault&&a.preventDefault(),!1)}function g(){void 0!==m&&(document.body.style.paddingRight=m,m=void 0),void 0!==l&&(document.body.style.overflow=l,l=void 0)}var h="undefined"!=typeof window&&window.navigator&&window.navigator.platform&&(/iP(ad\|ho

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1984)
Category:	downloaded
Size (bytes):	6518
Entropy (8bit):	5.267299812441108
Encrypted:	false
SSDEEP:
MD5:	763D5D48DDAB8C42085F4C78EC914CC1
SHA1:	EE6DCB20539CC6530926A0EBC60ABF576D04CF3B
SHA-256:	D1BF1AC5635A1BEA44EAAE82F5E19BF981D48BA9A50A9DEBA0DAD51B3A0BEB18
SHA-512:	5A11EF5B7FB9574F4CC91869E1F7213A69279FEA1332225A31E2480E6B8EA410F60271B0EBD9E023E3B2BF2ED12BADD376E334128391ED41093419549E44D64F
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/ys/r/ioxK2Ojkb1E.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("EventEmitterWithValidation",["BaseEventEmitter"],(function(a,b,c,d,e,f){"use strict";a=function(a){babelHelpers.inheritsLoose(b,a);function b(b,c){var d;d=a.call(this)\|\|this;d.$EventEmitterWithValidation1=Object.keys(b);d.$EventEmitterWithValidation2=Boolean(c);return d}var c=b.prototype;c.emit=function(b){if(this.$EventEmitterWithValidation1.indexOf(b)===-1){if(this.$EventEmitterWithValidation2)return;throw new TypeError(g(b,this.$EventEmitterWithValidation1))}return a.prototype.emit.apply(this,arguments)};return b}(b("BaseEventEmitter"));function g(a,b){a='Unknown event type "'+a+'". ';a+="Known event types: "+b.join(", ")+".";return a}e.exports=a}),null);.__d("mixInEventEmitter",["invariant","EventEmitterWithHolding","EventEmitterWithValidation","EventHolder"],(function(a,b,c,d,e,f,g,h){"use strict";function a(a,b,c){b\|\|h(0,3159);var d=a.prototype\|\|a;d.__eventEmitter&&h(0,3160);a=a.constructor;a&&(a===Object\|\|a===Function\|\|h(0,3161));d.__types=babelHelpers["e

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3811)
Category:	downloaded
Size (bytes):	9607
Entropy (8bit):	5.25756716381495
Encrypted:	false
SSDEEP:
MD5:	E7B1A9FA9F5B0E104B70778A7D1DDEE5
SHA1:	6C708924370427851CB0EDD70681D3F7B6834390
SHA-256:	17D0DB22428A6568152C1D237FF6622DDABB405B10A66191D5B27FEBA59C37CE
SHA-512:	4C77D3F555E0A6C4F6894DC131E3B9004BDF96C46283CA272B9F2971696444AED760F83D72C94761F5A65CAD8E5246324680060245356082B316ADF24D0BCF8C
Malicious:	false
Reputation:	low
URL:	"https://static.whatsapp.net/rsrc.php/v3/yz/l/0,cross/DrCz6qYhAK8.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	._90lg,._90lh{margin:0 auto;position:relative}._90lh{overflow:hidden}._90lg{width:100%}._90lg._94iv{direction:ltr}._94iv ._90lj{direction:rtl}._90lj{box-sizing:border-box;height:100%;position:absolute;width:100%}._90lr{border-bottom:3px solid #0063bf;bottom:1px;left:0;position:absolute;width:100px}._90lq{bottom:-30px;display:flex;justify-content:center;position:absolute;width:100%}._90lo{background-color:#d6d6d7;border-radius:100%;cursor:pointer;height:10px;margin:5px;transition:background-color .5s ease-in-out;width:10px}._90lo._90lp,._90lo:hover{background-color:#4080ff}._90ls,._90lt{cursor:pointer;position:absolute;top:50%;transform:translateY(-50%);z-index:1}._9ivz{display:none}._90ls{left:10px}._90lt{right:10px}._90ls ._90lu{background:url(/rsrc.php/v3/yN/r/GwXovD8XJHk.png);height:24px;width:24px}._90lt ._90lu{background:url(/rsrc.php/v3/y-/r/RqDd4K71N3I.png);height:24px;width:24px}._9j8l{cursor:pointer;position:absolute;right:0;top:-24px;z-index:1}._9j9f{background:url(/rsrc.php/

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	249969
Entropy (8bit):	5.863785387829829
Encrypted:	false
SSDEEP:
MD5:	8AB914B33A56FFA80CA1DE0819A70684
SHA1:	0A103D668F19BD5529DE831446389EABD85F3550
SHA-256:	B32CB4726155800367B1E44AF2FD940B77AED84CC9BAA11C0381BF35DD993C98
SHA-512:	25C7DE99552202067965AF9D381F732E1A7DA5AADEA450F20BE3ABA5561494686B9FB4A6538EDE324D9E677B311ADF3B7CA010C019E41E9D89AE092E9CCB44C8
Malicious:	false
Reputation:	low
URL:	https://web.whatsapp.com/libsignal-protocol-ee5b8ba.min.js
Preview:	!function(){var A=void 0,e={};window.libsignal={};var t,r=void 0!==r?r:{},n={};for(t in r)r.hasOwnProperty(t)&&(n[t]=r[t]);var g=[],o=!1,I=!1,s=!1,f=!1;o="object"==typeof window,I="function"==typeof importScripts,s="object"==typeof A&&"object"==typeof A.versions&&"string"==typeof A.versions.node,f=!o&&!s&&!I;var a,h,B,C,E="";function u(A){return r.locateFile?r.locateFile(A,E):E+A}s?(E=I?require("path").dirname(E)+"/":__dirname+"/",a=function(A,e){var t=oA(A);return t?e?t:t.toString():(B\|\|(B=require("fs")),C\|\|(C=require("path")),A=C.normalize(A),B.readFileSync(A,e?null:"utf8"))},h=function(A){var e=a(A,!0);return e.buffer\|\|(e=new Uint8Array(e)),d(e.buffer),e},A.argv.length>1&&A.argv[1].replace(/\\/g,"/"),g=A.argv.slice(2),"undefined"!=typeof module&&(module.exports=r),A.on("uncaughtException",(function(A){if(!(A instanceof BA))throw A})),A.on("unhandledRejection",x),r.inspect=function(){return"[Emscripten Module object]"}):f?("undefined"!=typeof read&&(a=function(A){var e=oA(A);return e

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x640, components 3
Category:	dropped
Size (bytes):	47984
Entropy (8bit):	7.9363555093931355
Encrypted:	false
SSDEEP:
MD5:	01FCDC86C6DD1736EA81D2E13D953691
SHA1:	DE4038ABAA3364FDAE426252E7E14503E9974022
SHA-256:	F25E286696464581EAB63CC669FE7E27E1DBCE4A28C25D9266CB2294062EC9F0
SHA-512:	4ECCDDB6740519C6BC46AF330159BC4814DA66F59EC8049903C692A13B3EDBD7EC0B5234161E6C6049F8AA0AC7FE275DA08823E5367348E16F0162FD3760F721
Malicious:	false
Reputation:	low
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................".........................................g..........................!Qa.1A.."Rq.2Bb......#.....SWr.....$3Cc.......4s...&5EG......%DFtu....67T..........................................................!1...Q"A2S...RaB............?.....W.{..m...{o...=..6..t.O y.O.?._.._{o...=..6......Y...a.~.:n...,..'...Nd..~.?......@}...........T (C.&.c{.9..nx..'.X&.

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18631)
Category:	downloaded
Size (bytes):	305418
Entropy (8bit):	5.41559677440503
Encrypted:	false
SSDEEP:
MD5:	3F9CD93126A976762D8812FC5E49C53E
SHA1:	FA28789200A8ADFC5EB15F04352F697DCB088310
SHA-256:	72A8A4B804A387725CFCB5C9DE282952BA66A7523C9E7D64A40CBDE6905FCDA9
SHA-512:	EF21E9AEC1894413C7666889611C76414A3FDB3EC782C7C92B40511772DA0B02016047A2F4931CD6F2B7D2DE704F9732338B926ABFF76B62FC0B2F29E363F9A7
Malicious:	false
Reputation:	low
URL:	https://static.whatsapp.net/rsrc.php/v3/yb/r/KSIi05cfjT6.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Static File Info

⊘No static file info

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://wa.me/447493588242

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\alfredo\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Chrome Cache Entry: 194

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 206

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 220

Chrome Cache Entry: 223

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 240

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 256

Windows Analysis Report
https://wa.me/447493588242