Edit tour

Windows Analysis Report
Whatsapp-GUI.exe

Overview

General Information

Sample name:	Whatsapp-GUI.exe
Analysis ID:	1575235
MD5:	8c3ef2eba970f543f0ebe6dced908402
SHA1:	431157eaf15244e5d8cc167511b4611f4dfae85c
SHA256:	9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
Tags:	DarkGateexeuser-smica83
Infos:

Detection

DarkGate, MailPassView

Score:	69
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	63
Range:	0 - 100

Signatures

Found malware configuration

Yara detected DarkGate

Yara detected MailPassView

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates autostart registry keys with suspicious names

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Whatsapp-GUI.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\Whatsapp-GUI.exe" MD5: 8C3EF2EBA970F543F0EBE6DCED908402)

UpdaterService.exe (PID: 7636 cmdline: "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x" MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cmd.exe (PID: 7684 cmdline: "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7732 cmdline: wmic ComputerSystem get domain MD5: E2DE6500DE1148C7F6027AD50AC8B891)

Autoit3.exe (PID: 8020 cmdline: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Autoit3.exe (PID: 8092 cmdline: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.	No Attribution	https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/ https://blog.sekoia.io/darkgate-internals/ https://blog.talosintelligence.com/darkgate-remote-template-injection/ https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/ https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate

Malware Configuration

Threatname: DarkGate

{"C2 url": "154.216.16.83", "check_ram": false, "crypter_rawstub": "Whatsapp", "crypter_dll": "PyKtS5QCVyLlgyPHS4pCp0F19IXDQAsFsMQc", "crypter_au3": 6, "flag_14": true, "crypto_key": 80, "startup_persistence": true, "flag_32": false, "anti_vm": false, "min_disk": false, "flag_18": 100, "anti_analysis": false, "min_ram": false, "flag_19": 4096, "check_disk": false, "flag_21": false, "flag_23": true, "flag_31": false, "flag_25": "rjacline01395", "flag_26": false, "flag_27": "VyUZUiNl", "flag_28": false, "flag_29": 2, "flag_35": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: UpdaterService.exe PID: 7636	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: UpdaterService.exe PID: 7636	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: Autoit3.exe PID: 8020	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Autoit3.exe PID: 8020	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: Autoit3.exe PID: 8092	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Autoit3.exe PID: 8092	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Click to see the 26 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x, EventID: 13, EventType: SetValue, Image: C:\ProgramData\Updater\UpdaterService.exe, ProcessId: 7636, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deafbbd

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000009.00000002.1966226527.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: DarkGate {"C2 url": "154.216.16.83", "check_ram": false, "crypter_rawstub": "Whatsapp", "crypter_dll": "PyKtS5QCVyLlgyPHS4pCp0F19IXDQAsFsMQc", "crypter_au3": 6, "flag_14": true, "crypto_key": 80, "startup_persistence": true, "flag_32": false, "anti_vm": false, "min_disk": false, "flag_18": 100, "anti_analysis": false, "min_ram": false, "flag_19": 4096, "check_disk": false, "flag_21": false, "flag_23": true, "flag_31": false, "flag_25": "rjacline01395", "flag_26": false, "flag_27": "VyUZUiNl", "flag_28": false, "flag_29": 2, "flag_35": false}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.2% probability

Compliance

PE / OLE file has a valid certificate

Source: Whatsapp-GUI.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49737 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Whatsapp-GUI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\Work\source\repos\Whatsapp-GUI\Whatsapp-GUI\obj\Debug\Whatsapp-GUI.pdb source: Whatsapp-GUI.exe

Spreading

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A4005
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AC2FF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A494A GetFileAttributesW,FindFirstFileW,FindClose,	9_2_008A494A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_008ACD9F
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD14 FindFirstFileW,FindClose,	9_2_008ACD14
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF5D8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF735
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AFA36
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A3CE2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1DB65 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_00F1DB65
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBA584 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	9_2_03BBA584
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B68AFC FindFirstFileA,GetLastError,	9_2_03B68AFC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B689F4 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	9_2_03B689F4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB31F8 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BB31F8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBBA70 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BBBA70
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B65974 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_03B65974
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7BD8C FindFirstFileA,FindNextFileA,FindClose,	9_2_03B7BD8C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B93D68 FindFirstFileW,FindNextFileW,FindClose,	9_2_03B93D68

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 154.216.16.83

Source: global traffic	HTTP traffic detected: GET /scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1 HTTP/1.1Host: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18
Source: Joe Sandbox View	IP Address: 162.125.69.15 162.125.69.15

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

9_2_008B29BA

Source: global traffic	HTTP traffic detected: GET /scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1 HTTP/1.1Host: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comConnection: Keep-Alive

Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Y44NPolicy: font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com

Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0&
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.comd
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ipU
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.0000000008A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/PW
Source: UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000000.1789844596.00000000000F9000.00000002.00000001.01000000.0000000C.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000000.1935094636.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe, 0000000A.00000000.2015835231.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/u/0/#inbox
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaR
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: Whatsapp-GUI.exe	String found in binary or memory: https://www.dropbox.com/scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: Autoit3.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

9_2_008B4632

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

9_2_008B4830

Source: C:\ProgramData\bfadeeb\Autoit3.exe

9_2_008B4632

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B9B188 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

9_2_03B9B188

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A0508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

9_2_008A0508

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0765B930 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0765B930
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008CD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		9_2_008CD164

Protection of GUI

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BB2170 OpenDesktopA,CreateDesktopA,SetThreadDesktop,CreateProcessA,

9_2_03BB2170

System Summary

Source: C:\ProgramData\Updater\UpdaterService.exe

Process Stats: CPU usage > 49%

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB43EC NtDuplicateObject,NtClose,	9_2_03BB43EC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB476C Sleep,TerminateThread,NtClose,NtClose,	9_2_03BB476C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB44C8 NtQuerySystemInformation,NtDuplicateObject,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,	9_2_03BB44C8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB4420 NtQueryObject,NtQueryObject,	9_2_03BB4420
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB4478 NtOpenProcess,	9_2_03BB4478
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8AF84 GetCurrentProcessId,OpenProcess,InitializeProcThreadAttributeList,GetProcessHeap,RtlAllocateHeap,InitializeProcThreadAttributeList,UpdateProcThreadAttribute,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	9_2_03B8AF84
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B92CF0 BeginPaint,SetBkMode,TextOutA,EndPaint,PostQuitMessage,NtdllDefWindowProc_A,	9_2_03B92CF0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8B2A4 GetCurrentProcessId,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	9_2_03B8B2A4

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A42D5: CreateFileW,DeviceIoControl,CloseHandle,

9_2_008A42D5

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00898F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

9_2_00898F2E

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

9_2_008A5778

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0116D55C	0_2_0116D55C
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0765075B	0_2_0765075B
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_076558C0	0_2_076558C0
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F734BA	2_3_04F734BA
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F734BA	2_3_04F734BA
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F2B43F	2_3_04F2B43F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F2B43F	2_3_04F2B43F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F20625	2_3_04F20625
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F20625	2_3_04F20625
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1F7D1	2_3_04F1F7D1
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1F7D1	2_3_04F1F7D1
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F250DE	2_3_04F250DE
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F250DE	2_3_04F250DE
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F14134	2_3_04F14134
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F14134	2_3_04F14134
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1A343	2_3_04F1A343
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1A343	2_3_04F1A343
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F5B8C4	2_3_04F5B8C4
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F5B8C4	2_3_04F5B8C4
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F51832	2_3_04F51832
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F51832	2_3_04F51832
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F29A66	2_3_04F29A66
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F29A66	2_3_04F29A66
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1EA56	2_3_04F1EA56
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1EA56	2_3_04F1EA56
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084B020	9_2_0084B020
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00841663	9_2_00841663
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00849C80	9_2_00849C80
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008623F5	9_2_008623F5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C8400	9_2_008C8400
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876502	9_2_00876502
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084E6F0	9_2_0084E6F0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0087265E	9_2_0087265E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086282A	9_2_0086282A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008789BF	9_2_008789BF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C0A3A	9_2_008C0A3A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876A74	9_2_00876A74
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00850BE0	9_2_00850BE0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0089EDB2	9_2_0089EDB2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086CD51	9_2_0086CD51
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C0EB7	9_2_008C0EB7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A8E44	9_2_008A8E44
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876FE6	9_2_00876FE6
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008633B7	9_2_008633B7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008494E0	9_2_008494E0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086F409	9_2_0086F409
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085D45D	9_2_0085D45D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084F6A0	9_2_0084F6A0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008616B4	9_2_008616B4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085F628	9_2_0085F628
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008678C3	9_2_008678C3
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086DBA5	9_2_0086DBA5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00861BA8	9_2_00861BA8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00879CE5	9_2_00879CE5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085DD28	9_2_0085DD28
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00861FC0	9_2_00861FC0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086BFD6	9_2_0086BFD6
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C	9_2_03B8A79C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B86438	9_2_03B86438
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B9EC00	9_2_03B9EC00
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BAB1B8	9_2_03BAB1B8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BA9BD0	9_2_03BA9BD0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\Updater\UpdaterService.exe (copy) 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F1B5B0 appears 59 times
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F1CA25 appears 36 times
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F245F0 appears 46 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64394 appears 101 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B921B8 appears 36 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00868B30 appears 42 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00851A36 appears 34 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00860D17 appears 70 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B66980 appears 111 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64668 appears 48 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64904 appears 92 times

Source: Whatsapp-GUI.exe, 00000000.00000002.1816344898.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Whatsapp-GUI.exe

Source: classification engine

Classification label: mal69.troj.spyw.evad.winEXE@10/12@2/3

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AA6AD GetLastError,FormatMessageW,

9_2_008AA6AD

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00898DE9 AdjustTokenPrivileges,CloseHandle,		9_2_00898DE9
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00899399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		9_2_00899399

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AB976 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

9_2_008AB976

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

9_2_008A4148

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AC9DA CoInitialize,CoCreateInstance,CoUninitialize,

9_2_008AC9DA

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

9_2_008A443D

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Whatsapp-GUI.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03

Source: C:\ProgramData\Updater\UpdaterService.exe

File created: C:\temp\

Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Command line argument: 0k

9_2_00855F8B

Source: Whatsapp-GUI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\Updater\UpdaterService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: Whatsapp-GUI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Whatsapp-GUI.exe "C:\Users\user\Desktop\Whatsapp-GUI.exe"
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain
Source: unknown	Process created: C:\ProgramData\bfadeeb\Autoit3.exe "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Source: unknown	Process created: C:\ProgramData\bfadeeb\Autoit3.exe "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: Whatsapp-GUI.exe

Static PE information: certificate valid

PE file contains a COM descriptor data directory

Source: Whatsapp-GUI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Whatsapp-GUI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: Whatsapp-GUI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\Work\source\repos\Whatsapp-GUI\Whatsapp-GUI\obj\Debug\Whatsapp-GUI.pdb source: Whatsapp-GUI.exe

Data Obfuscation

Source: Whatsapp-GUI.exe

Static PE information: 0x8CE2628A [Fri Nov 25 00:30:02 2044 UTC]

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008BC6D9 LoadLibraryA,GetProcAddress,

9_2_008BC6D9

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_09E0399D push FFFFFF8Bh; iretd	0_2_09E0399F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1B5F5 push ecx; ret	2_3_04F1B608
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1B5F5 push ecx; ret	2_3_04F1B608
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04EF770A push esi; ret	2_3_04EF770D
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04EF770A push esi; ret	2_3_04EF770D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086E93F push edi; ret	9_2_0086E941
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A8A4A push FFFFFF8Bh; iretd	9_2_008A8A4C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086EA58 push esi; ret	9_2_0086EA5A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00868B75 push ecx; ret	9_2_00868B88
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086EC33 push esi; ret	9_2_0086EC35
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086ED1C push edi; ret	9_2_0086ED1E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E1C1 push 00F1E212h; ret	9_2_00F1E20A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1C225 push eax; ret	9_2_00F1C261
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F223A9 push 00F223CFh; ret	9_2_00F223C7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1F4C1 push ecx; mov dword ptr [esp], eax	9_2_00F1F4C2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E441 push 00F1E46Dh; ret	9_2_00F1E465
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E409 push 00F1E435h; ret	9_2_00F1E42D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E58A push 00F1E835h; ret	9_2_00F1E82D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E551 push 00F1E57Dh; ret	9_2_00F1E575
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E809 push 00F1E835h; ret	9_2_00F1E82D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21ABD push 00F21C39h; ret	9_2_00F21C31
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21C3B push 00F21CACh; ret	9_2_00F21CA4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21C3D push 00F21CACh; ret	9_2_00F21CA4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F2AEBC pushad ; ret	9_2_00F2AEF9
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB83A0 push 03BB83CCh; ret	9_2_03BB83C4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB43A4 push 03BB43D0h; ret	9_2_03BB43C8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7C380 push 03B7C3B4h; ret	9_2_03B7C3AC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7C388 push 03B7C3B4h; ret	9_2_03B7C3AC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB83D8 push 03BB8404h; ret	9_2_03BB83FC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB8330 push 03BB835Ch; ret	9_2_03BB8354
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB8368 push 03BB8394h; ret	9_2_03BB838C

Persistence and Installation Behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	File created: C:\ProgramData\bfadeeb\Autoit3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\UpdaterService.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\Autoit3.exe	Jump to dropped file

Source: C:\ProgramData\Updater\UpdaterService.exe	File created: C:\ProgramData\bfadeeb\Autoit3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\UpdaterService.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\Autoit3.exe	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\ProgramData\Updater\UpdaterService.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd

Jump to behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd			Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		9_2_008C59B3
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00855EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		9_2_00855EDA

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008633B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_008633B7

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BBC828

9_2_03BBC828

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SUPERANTISPYWARE.EXE

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Thread delayed: delay time: 1800000			Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Window / User API: threadDelayed 2383	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Window / User API: threadDelayed 7448	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: threadDelayed 1914	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: threadDelayed 1127	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: foregroundWindowGot 1390	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

API coverage: 4.9 %

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BBC828

9_2_03BBC828

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99857s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99529s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99307s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98809s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96395s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95930s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94390s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7780	Thread sleep time: -454500s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7796	Thread sleep time: -9000000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7780	Thread sleep time: -1690500s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7792	Thread sleep time: -121000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Domain FROM Win32_ComputerSystem

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Last function: Thread delayed
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Last function: Thread delayed

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A4005
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AC2FF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A494A GetFileAttributesW,FindFirstFileW,FindClose,	9_2_008A494A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_008ACD9F
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD14 FindFirstFileW,FindClose,	9_2_008ACD14
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF5D8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF735
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AFA36
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A3CE2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1DB65 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_00F1DB65
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBA584 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	9_2_03BBA584
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B68AFC FindFirstFileA,GetLastError,	9_2_03B68AFC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B689F4 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	9_2_03B689F4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB31F8 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BB31F8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBBA70 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BBBA70
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B65974 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_03B65974
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7BD8C FindFirstFileA,FindNextFileA,FindClose,	9_2_03B7BD8C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B93D68 FindFirstFileW,FindNextFileW,FindClose,	9_2_03B93D68

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_00855D13

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99857	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99748	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99639	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99529	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99307	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99202	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99079	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98809	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98593	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97937	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97499	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97171	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96843	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96734	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96624	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96395	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95930	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95155	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94826	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94390	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Thread delayed: delay time: 1800000	Jump to behavior

Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.0000000008A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: Whatsapp-GUI.exe, 00000000.00000002.1816344898.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.00000000089A0000.00000004.00000020.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1964958277.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2041037254.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\Updater\UpdaterService.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B45D5 BlockInput,

9_2_008B45D5

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

9_2_00855240

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00875CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

9_2_00875CAC

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008BC6D9 LoadLibraryA,GetProcAddress,

9_2_008BC6D9

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F2A766 mov eax, dword ptr fs:[00000030h]	9_2_00F2A766
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B880A4 mov eax, dword ptr fs:[00000030h]	9_2_03B880A4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C mov eax, dword ptr fs:[00000030h]	9_2_03B8A79C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C mov eax, dword ptr fs:[00000030h]	9_2_03B8A79C

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008988CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

9_2_008988CD

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_0086A385
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086A354 SetUnhandledExceptionFilter,		9_2_0086A354

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B8DCB8 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

9_2_03B8DCB8

Contains functionality to inject threads in other processes

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B8DCB8 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

9_2_03B8DCB8

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00899369 LogonUserW,

9_2_00899369

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

9_2_00855240

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A1AC6 SendInput,keybd_event,

9_2_008A1AC6

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A51E2 mouse_event,

9_2_008A51E2

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

9_2_008988CD

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

9_2_008A4F1C

Source: UpdaterService.exe, 00000002.00000000.1789777520.00000000000E6000.00000002.00000001.01000000.0000000C.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005083000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834752096.0000000004FA8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: program manager&
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managertem32
Source: UpdaterService.exe, Autoit3.exe	Binary or memory string: Shell_TrayWnd
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagertonT
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerATAT
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: program manager
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerInfo

Language, Device and Operating System Detection

Source: C:\ProgramData\Updater\UpdaterService.exe

Code function: 2_3_04F1B2DB cpuid

2_3_04F1B2DB

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_00F1DD3D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F20021
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,GetACP,	9_2_00F21179
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F1E14D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_00F1DE47
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F1FFD5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_03B65B4C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B66470
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,GetACP,	9_2_03B6CC88
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B6B620
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B6B66C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_03B65C56

Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Users\user\Desktop\Whatsapp-GUI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00880030 GetLocalTime,__swprintf,

9_2_00880030

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00880722 GetUserNameW,

9_2_00880722

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_0087416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

9_2_0087416A

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_00855D13

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: superantispyware.exe

Stealing of Sensitive Information

Yara detected DarkGate

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Yara detected MailPassView

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Source: Autoit3.exe	Binary or memory string: WIN_81
Source: Autoit3.exe	Binary or memory string: WIN_XP
Source: Autoit3.exe	Binary or memory string: WIN_XPe
Source: Autoit3.exe	Binary or memory string: WIN_VISTA
Source: Autoit3.exe	Binary or memory string: WIN_7
Source: Autoit3.exe	Binary or memory string: WIN_8
Source: Autoit3.exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected DarkGate

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008B696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	9_2_008B696E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008B6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	9_2_008B6E32
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7CCB4 bind,	9_2_03B7CCB4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Timestomp	NTDS	66 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	261 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Whatsapp-GUI.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkGate

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Whatsapp-GUI.exe