Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\shopeechat\.update\autoupdate.ini
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0024@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0025@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0026@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0027@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0028@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0029@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#01@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#02@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#03@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#04@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#05@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#06@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0022@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0023@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#07@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#10@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#11@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#12@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#13@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#14@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#15@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#16@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#17@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#18@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#19@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#20@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#21@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#08@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#09@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0021@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0020@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0019@1x.png
- %LOCALAPPDATA%\shopeechat\.update\updatepackage.zip
- %LOCALAPPDATA%\shopeechat\.update\unzip\minibrowser.exe
- %LOCALAPPDATA%\shopeechat\.update\unzip\node.dll
- %LOCALAPPDATA%\shopeechat\.update\unzip\shopeechat.exe
- %LOCALAPPDATA%\shopeechat\.update\unzip\shopeechat.exe.config
- %LOCALAPPDATA%\shopeechat\.update\unzip\x86\sqlite.interop.dll
- <Current directory>\autoupdate.exe
- C:\temp\shopeeclog\2021-09-05_18.log
- %LOCALAPPDATA%\shopeechat\storage\local.db-journal
- %LOCALAPPDATA%\shopeechat\storage\local.db
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0001@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0002@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0003@1x.png
- %LOCALAPPDATA%\shopeechat\.update\autoupdate.exe
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0004@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0006@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0007@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0008@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0009@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0010@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0011@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0012@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0013@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0014@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0015@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0016@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0017@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0018@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\ph\tarsiers_ph#0005@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#22@1x.png
- %LOCALAPPDATA%\shopeechat\.sticker\my\orangutan_my_new#23@1x.png
Deletes the following files
- %LOCALAPPDATA%\shopeechat\.update\updatepackage.zip
- %LOCALAPPDATA%\shopeechat\storage\local.db-journal
Moves the following files
- from %LOCALAPPDATA%\shopeechat\.update\unzip\x86\sqlite.interop.dll to <Current directory>\x86\sqlite.interop.dll
- from %LOCALAPPDATA%\shopeechat\.update\unzip\minibrowser.exe to <Current directory>\minibrowser.exe
- from %LOCALAPPDATA%\shopeechat\.update\unzip\node.dll to <Current directory>\node.dll
- from %LOCALAPPDATA%\shopeechat\.update\unzip\shopeechat.exe to <Current directory>\shopeechat.exe
- from %LOCALAPPDATA%\shopeechat\.update\unzip\shopeechat.exe.config to <Current directory>\shopeechat.exe.config
Substitutes the following files
- %LOCALAPPDATA%\shopeechat\storage\local.db-journal
Deletes itself.
Network activity
Connects to
- 'sh###ecrm.com':80
- 'do###########1658.cos.ap-shanghai.myqcloud.com':443
- 'de#.###peemobile.com':443
- 'cd######anow-a.akamaihd.net':443
TCP
HTTP POST requests
- http://www.sh###ecrm.com/api/v1/getVersion.json
Other
- 'do###########1658.cos.ap-shanghai.myqcloud.com':443
- 'de#.###peemobile.com':443
- 'cd######anow-a.akamaihd.net':443
UDP
- DNS ASK sh###ecrm.com
- DNS ASK do###########1658.cos.ap-shanghai.myqcloud.com
- DNS ASK de#.###peemobile.com
- DNS ASK cd######anow-a.akamaihd.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '???'
Creates and executes the following
- '%LOCALAPPDATA%\shopeechat\.update\autoupdate.exe'
- '<Current directory>\shopeechat.exe'
