Edit tour

Windows Analysis Report
msupdate.exe

Overview

General Information

Sample name:	msupdate.exe
Analysis ID:	1467960
MD5:	a4a77855a747fd6c8a28cfa4e0e3b22f
SHA1:	a201051faf269ffa09dee1b3d0ea8db4958aba7c
SHA256:	3595fb2e596d3e1ab25f1671e4d0b541924fae29fd7ffbda09a929978707609a
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Python Keylogger

AI detected suspicious sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected EXE embedded in BAT file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

msupdate.exe (PID: 2444 cmdline: "C:\Users\user\Desktop\msupdate.exe" MD5: A4A77855A747FD6C8A28CFA4E0E3B22F)

localtest.exe (PID: 432 cmdline: "C:\Users\user\Desktop\msupdate.exe" MD5: 45AD175640562F376718FCF3C0FC0D93)

cmd.exe (PID: 4824 cmdline: C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3040 cmdline: C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3456 cmdline: powershell rm WindowsSecurityService.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5648 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4936 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

MicrosoftSecurityUpdate.exe (PID: 3700 cmdline: "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" MD5: A4A77855A747FD6C8A28CFA4E0E3B22F)

localtest.exe (PID: 5092 cmdline: "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" MD5: 45AD175640562F376718FCF3C0FC0D93)

cmd.exe (PID: 3032 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5040 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

MicrosoftSecurityUpdate.exe (PID: 5244 cmdline: "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" MD5: A4A77855A747FD6C8A28CFA4E0E3B22F)

localtest.exe (PID: 6664 cmdline: "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe" MD5: 45AD175640562F376718FCF3C0FC0D93)

cmd.exe (PID: 2616 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5292 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	JoeSecurity_EXEembeddedinBATfile	Yara detected EXE embedded in BAT file	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	JoeSecurity_PythonKeylogger	Yara detected Python Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	JoeSecurity_EXEembeddedinBATfile	Yara detected EXE embedded in BAT file	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	JoeSecurity_PythonKeylogger	Yara detected Python Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	JoeSecurity_EXEembeddedinBATfile	Yara detected EXE embedded in BAT file	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	JoeSecurity_PythonKeylogger	Yara detected Python Keylogger	Joe Security
Click to see the 4 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe, ProcessId: 432, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell rm WindowsSecurityService.exe, CommandLine: powershell rm WindowsSecurityService.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3040, ParentProcessName: cmd.exe, ProcessCommandLine: powershell rm WindowsSecurityService.exe, ProcessId: 3456, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: msupdate.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: geolocation-db.com

Source: msupdate.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb++ source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdbdd" source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\dsengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\unicodedata.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\qtmedia_audioengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: placed in the .pdbrc file): source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: If a file ".pdbrc" exists in your home directory or in the current source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbRR source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbrc) source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: signToolcAToolsignToolCertcAToolCertISSUER_SIGN_TOOLv2i_issuer_sign_toolcrypto\x509\v3_ist.ci2r_issuer_sign_tool%ssignTool : %scATool : %ssignToolCert: %scAToolCert : compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: PKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excrypto\bio\bio_sock.cBIO_sock_initcalling wsastartup()BIO_socket_ioctlcalling ioctlsocket()i2d_ASN1_bio_streamcrypto\asn1\asn_mime.cB64_write_ASN1-----BEGIN %s----- source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\printsupport\windowsprintersupport.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: -c are executed after commands from .pdbrc files. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qoffscreen.pdbKK source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: challengeNETSCAPE_SPKACspkacsig_algorcrypto\bn\bn_exp.cBN_mod_exp_recpBN_mod_exp_mont_wordX509V3_EXT_nconf_intcrypto\x509\v3_conf.csection=%s, name=%s, value=%sdo_ext_nconfname=%s,section=%sdo_ext_i2dX509V3_EXT_i2dcritical,DER:ASN1:v3_generic_extensionvalue=%sX509V3_get_sectioncrypto\x509\v3_lib.cX509V3_add1_i2dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.0.5built on: Tue Jul 5 11:53:43 2022 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot available source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Initial commands are read from .pdbrc files in your home directory source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\bob\openssl-1.0.2s\out32dll\ssleay32.pdbFF source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\select.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ~/.pdbrcz source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtwebglplugin\plugins\platforms\qwebgl.pdb11 source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CCF85000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qminimal.pdbPP source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\cryptography\cryptography\cryptography-37.0.4\src\rust\target\release\deps\cryptography_rust.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5D0719000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\sqlite3.pdb source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: The standard debugger class (pdb.Pdb) is an example. source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\mediaservice\wmfengine.pdbLL' source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp\ONEFIL~1\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\pygame\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.8:49723 -> 121.127.33.39:9333

Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View	IP Address: 151.80.29.83 151.80.29.83
Source: Joe Sandbox View	IP Address: 159.89.102.253 159.89.102.253
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 550Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 549Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 405Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39
Source: unknown	TCP traffic detected without corresponding DNS query: 121.127.33.39

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.7Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.33 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.7Connection: close

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: geolocation-db.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1146548767999410288/8R6cuyUo7dPOdjaa917fiMLvb0BAMODXJM_yHr79eoRbbKFeYIV3t4Eq6ZSDj4BcB-lg HTTP/1.1Accept-Encoding: identityContent-Length: 331Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe, type: DROPPED

Source: zlib1.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libfreetype-6.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: Number of sections : 19 > 10
Source: libpng16-16.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: sdl2_image.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: sdl2_ttf.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libjpeg-9.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: sdl2_mixer.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: cv2.pyd.0.dr	Static PE information: Number of sections : 11 > 10
Source: sdl2.dll.0.dr	Static PE information: Number of sections : 12 > 10

Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametcl86.dllP vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametk86.dllP vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQt5Widgets.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSDL2.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSDL_image.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSDL_mixer.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSDL_ttf.dllR vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqjpeg.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqsvg.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqtga.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqtiff.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqwbmp.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqwebp.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedsengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqtmedia_audioengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewmfengine.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqminimal.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqoffscreen.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqwebgl.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqwindows.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewindowsprintersupport.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqsvgicon.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqgif.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqicns.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqico.dll( vs msupdate.exe
Source: msupdate.exe, 00000000.00000000.1434489470.00007FF65DBBF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelocaltest.exe4 vs msupdate.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_03

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);

Source: unknown	Process created: C:\Users\user\Desktop\msupdate.exe "C:\Users\user\Desktop\msupdate.exe"
Source: C:\Users\user\Desktop\msupdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe "C:\Users\user\Desktop\msupdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell rm WindowsSecurityService.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\msupdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe "C:\Users\user\Desktop\msupdate.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mv WindowsSecurityService.exe C:\Users\user\AppData\Roaming\MicrosoftSupport\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell rm WindowsSecurityService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell rm WindowsSecurityService.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe "C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist

Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: msupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: msupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: msupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: msupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: msupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: msupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CF013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CF013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/sca.code3.crt06
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arxiv.org/abs/1805.10941.
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://caffe.berkeleyvision.org
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://caffe.berkeleyvision.org/)
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://campar.in.tum.de/Chair/HandEyeCalibration).
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdf
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.131.6394
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.startssl.com/sca-code3.crl0#
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CED94000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CE896000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5CDE96000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFD19000.00000004.00000020.00020000.00000000.sdmp, msupdate.exe, 00000000.00000003.1519534830.000001E5CFA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF62253E000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dx.doi.org/10.1016/j.cviu.2010.01.011
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: localtest.exe, 00000002.00000000.1536156208.00007FF6220FE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: msupdate.exe, 00000000.00000003.1519534830.000001E5D4319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/

Source: msupdate.exe	Static PE information: section name: _RDATA
Source: localtest.exe.0.dr	Static PE information: section name: _RDATA
Source: qwindows.dll.0.dr	Static PE information: section name: .qtmetad
Source: qxdgdesktopportal.dll.0.dr	Static PE information: section name: .qtmetad
Source: windowsprintersupport.dll.0.dr	Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.0.dr	Static PE information: section name: .qtmetad
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libfreetype-6.dll.0.dr	Static PE information: section name: .xdata
Source: libjpeg-9.dll.0.dr	Static PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /4
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /19
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /31
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /45
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /57
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /70
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /81
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.0.dr	Static PE information: section name: /92
Source: libpng16-16.dll.0.dr	Static PE information: section name: .xdata
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: qt5core.dll.0.dr	Static PE information: section name: .qtmimed
Source: sdl2.dll.0.dr	Static PE information: section name: .xdata
Source: sdl2_image.dll.0.dr	Static PE information: section name: .xdata
Source: sdl2_mixer.dll.0.dr	Static PE information: section name: .xdata
Source: sdl2_ttf.dll.0.dr	Static PE information: section name: .xdata
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: zlib1.dll.0.dr	Static PE information: section name: .xdata
Source: qsvgicon.dll.0.dr	Static PE information: section name: .qtmetad
Source: qgif.dll.0.dr	Static PE information: section name: .qtmetad
Source: qicns.dll.0.dr	Static PE information: section name: .qtmetad
Source: qico.dll.0.dr	Static PE information: section name: .qtmetad
Source: qjpeg.dll.0.dr	Static PE information: section name: .qtmetad
Source: qsvg.dll.0.dr	Static PE information: section name: .qtmetad
Source: qtga.dll.0.dr	Static PE information: section name: .qtmetad
Source: qtiff.dll.0.dr	Static PE information: section name: .qtmetad
Source: qwbmp.dll.0.dr	Static PE information: section name: .qtmetad
Source: qwebp.dll.0.dr	Static PE information: section name: .qtmetad
Source: dsengine.dll.0.dr	Static PE information: section name: .qtmetad
Source: qtmedia_audioengine.dll.0.dr	Static PE information: section name: .qtmetad
Source: wmfengine.dll.0.dr	Static PE information: section name: .qtmetad
Source: qminimal.dll.0.dr	Static PE information: section name: .qtmetad
Source: qoffscreen.dll.0.dr	Static PE information: section name: .qtmetad
Source: qwebgl.dll.0.dr	Static PE information: section name: .qtmetad
Source: cv2.pyd.0.dr	Static PE information: section name: IPPCODE
Source: cv2.pyd.0.dr	Static PE information: section name: IPPDATA
Source: cv2.pyd.0.dr	Static PE information: section name: _RDATA
Source: _portaudio.pyd.0.dr	Static PE information: section name: _RDATA
Source: math.pyd.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft			Jump to behavior

Source: C:\Users\user\Desktop\msupdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\msupdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Window / User API: threadDelayed 1513	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Window / User API: threadDelayed 8452	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5580	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2288	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Window / User API: threadDelayed 6148	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	Window / User API: threadDelayed 3816	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	Window / User API: threadDelayed 9960	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080	Thread sleep count: 1513 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080	Thread sleep time: -1513000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080	Thread sleep count: 8452 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe TID: 2080	Thread sleep time: -8452000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 5580 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 2288 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2944	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240	Thread sleep count: 6148 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240	Thread sleep time: -6148000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240	Thread sleep count: 3816 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe TID: 5240	Thread sleep time: -3816000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe TID: 6136	Thread sleep count: 9960 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe TID: 6136	Thread sleep time: -9960000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3700_133646285352975123\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_5244_133646285434309074\localtest.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	11 Input Capture	2 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report msupdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_101zxqon.hsd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d32txty0.s15.psm1

C:\Users\user\AppData\Local\Temp\crcook.txt

C:\Users\user\AppData\Local\Temp\crpassw.txt

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ofb.pyd

C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_BLAKE2s.pyd

Windows Analysis Report
msupdate.exe

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imaging.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingcms.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingft.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_imagingtk.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PIL\_webp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtCore.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtGui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\QtWidgets.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\iconengines\qsvgicon.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qgif.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qicns.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qico.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qjpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qsvg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtga.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qtiff.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwbmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\imageformats\qwebp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\dsengine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\mediaservice\wmfengine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qminimal.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qoffscreen.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwebgl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platforms\qwindows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\PyQt5\sip.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_brotli.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_portaudio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\bcrypt\_bcrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\concrt140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_openssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\cv2\cv2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libeay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libfreetype-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libjpeg-9.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libpng16-16.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\_version.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\lz4\block\_block.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\msvcp140_1.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://github.com/aio-libs/aiohttp/discussions/6044	0%	Avira URL Cloud	safe
https://coinbase.com)	0%	Avira URL Cloud	safe
https://onnx.ai/)	0%	Avira URL Cloud	safe
http://docs.python.org/library/unittest.html	0%	Avira URL Cloud	safe
https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp	0%	Avira URL Cloud	safe
https://tiktok.com)	0%	Avira URL Cloud	safe
http://caffe.berkeleyvision.org/)	0%	Avira URL Cloud	safe
https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu	0%	Avira URL Cloud	safe
http://www.megginson.com/SAX/.	0%	Avira URL Cloud	safe
http://torch.ch/)	0%	Avira URL Cloud	safe
https://discord.com)	0%	Avira URL Cloud	safe
https://github.com/opencv/opencv/issues/6293	0%	Avira URL Cloud	safe
https://github.com/opencv/opencv/issues/16739	0%	Avira URL Cloud	safe
https://github.com/torch/nn/blob/master/doc/module.md	0%	Avira URL Cloud	safe
https://youtube.com)	0%	Avira URL Cloud	safe
http://crl.startssl.com/sca-code3.crl0#	0%	Avira URL Cloud	safe
https://xbox.com)	0%	Avira URL Cloud	safe
https://paypal.com)	0%	Avira URL Cloud	safe
https://refspecs.linuxfoundation.org/elf/gabi4	0%	Avira URL Cloud	safe
https://github.com/opencv/opencv/issues/16736	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc3610	0%	Avira URL Cloud	safe
https://www.littlecms.com	0%	Avira URL Cloud	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	Avira URL Cloud	safe
http://speleotrove.com/decimal/decarith.html	0%	Avira URL Cloud	safe
http://www.gdal.org/ogr_formats.html).	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7	0%	Avira URL Cloud	safe
http://json.org	0%	Avira URL Cloud	safe
http://arxiv.org/abs/1805.10941.	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
https://www.tensorflow.org/)	0%	Avira URL Cloud	safe
http://xml.python.org/entities/fragment-builder/internalz	0%	Avira URL Cloud	safe
https://crunchyroll.com)	0%	Avira URL Cloud	safe
https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.x	0%	Avira URL Cloud	safe
https://coinbase.com)u	0%	Avira URL Cloud	safe
https://exiv2.org/tags.html)	0%	Avira URL Cloud	safe
https://ebay.com)	0%	Avira URL Cloud	safe
http://mathworld.wolfram.com/NegativeBinomialDistribution.html	0%	Avira URL Cloud	safe
https://i.imgur.com/CGxuBuK.pnguhttps://cdn.discordapp.com/avatars/w/aG3tb1ll1ngaG3tB4dg31aG3tUHQFr1	0%	Avira URL Cloud	safe
https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html	0%	Avira URL Cloud	safe
http://www.startssl.com/policy0	0%	Avira URL Cloud	safe
https://gmail.com)u	0%	Avira URL Cloud	safe
http://mathworld.wolfram.com/CauchyDistribution.html	0%	Avira URL Cloud	safe
https://github.com/pypa/packagingz	0%	Avira URL Cloud	safe
https://playstation.com)	0%	Avira URL Cloud	safe
https://brew.sh	0%	Avira URL Cloud	safe
http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).COLOR_SPACE_Lab_D75_2MORPH_CROSSCAP_PROP_DC1394	0%	Avira URL Cloud	safe
https://sellix.io)	0%	Avira URL Cloud	safe
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdf	0%	Avira URL Cloud	safe
https://onnx.ai/	0%	Avira URL Cloud	safe
http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/	0%	Avira URL Cloud	safe
http://www.zlib.net/D	0%	Avira URL Cloud	safe
https://software.intel.com/openvino-toolkit)	0%	Avira URL Cloud	safe
http://caffe.berkeleyvision.org	0%	Avira URL Cloud	safe
https://github.com/jaraco/jaraco.functools/issues/5	0%	Avira URL Cloud	safe
http://www.rfc-editor.org/info/rfc7253	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/cornersQualityOOOO	0%	Avira URL Cloud	safe
https://www.cazabon.com	0%	Avira URL Cloud	safe
http://www.openssl.org/V	0%	Avira URL Cloud	safe
https://geolocation-db.com/jsonp/areplaceT	0%	Avira URL Cloud	safe
https://gmail.com)	0%	Avira URL Cloud	safe
https://netflix.com)	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://www.cs.tut.fi/~foi/GCF-BM3D/BM3D_TIP_2007.pdf	0%	Avira URL Cloud	safe
https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-	0%	Avira URL Cloud	safe
https://outlook.com)	0%	Avira URL Cloud	safe
http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz	0%	Avira URL Cloud	safe
https://youtube.com)u	0%	Avira URL Cloud	safe
http://pracrand.sourceforge.net/RNG_engines.txt	0%	Avira URL Cloud	safe
http://tip.tcl.tk/48)	0%	Avira URL Cloud	safe
https://binance.com)	0%	Avira URL Cloud	safe
https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf	0%	Avira URL Cloud	safe
https://spotify.com)	0%	Avira URL Cloud	safe
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.131.6394	0%	Avira URL Cloud	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	Avira URL Cloud	safe
http://docs.python.org/library/itertools.html#recipes	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
https://discord.com/api/users/	0%	Avira URL Cloud	safe
https://steam.com)	0%	Avira URL Cloud	safe
http://www.ipol.im/pub/algo/bcm_non_local_means_denoising	0%	Avira URL Cloud	safe
https://api.gofile.io/getServer	0%	Avira URL Cloud	safe
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	0%	Avira URL Cloud	safe
https://dejavu-fonts.github.io/	0%	Avira URL Cloud	safe
http://www.ipol.im/pub/art/2011/ys-dct/	0%	Avira URL Cloud	safe
https://arxiv.org/abs/1704.04503	0%	Avira URL Cloud	safe
https://hbo.com)	0%	Avira URL Cloud	safe
https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki	0%	Avira URL Cloud	safe
http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/	0%	Avira URL Cloud	safe
https://twitter.com)	0%	Avira URL Cloud	safe
http://www.nightmare.com/squirl/python-ext/misc/syslog.py	0%	Avira URL Cloud	safe
http://www.pcg-random.org/	0%	Avira URL Cloud	safe
https://geolocation-db.com/jsonp/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
discord.com	162.159.137.232	true	false	unknown
api.ipify.org	172.67.74.152	true	false	unknown
geolocation-db.com	159.89.102.253	true	true	unknown
api.gofile.io	151.80.29.83	true	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
121.127.33.39	unknown	Afghanistan	55732	RANATECHNET-AFRANATechnologiesKabulAF	false
162.159.137.232	discord.com	United States	13335	CLOUDFLARENETUS	false
151.80.29.83	api.gofile.io	Italy	16276	OVHFR	false
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467960
Start date and time:	2024-07-05 06:47:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	msupdate.exe
Detection:	MAL
Classification:	mal76.spyw.evad.winEXE@32/508@4/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Time	Type	Description
00:48:41	API Interceptor	5x Sleep call for process: powershell.exe modified
00:49:10	API Interceptor	2516423x Sleep call for process: localtest.exe modified
06:48:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe
06:48:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Microsoft C:\Users\user\AppData\Roaming\MicrosoftSupport\MicrosoftSecurityUpdate.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.137.232	SecuriteInfo.com.Trojan.AutoIt.1410.29083.29061.exe	Get hash	malicious	Stealerium	Browse
	https://gateway.ipfs.io/ipfs/QmTpqHPNnTfSP4qyazECwFpuNnejL7wVoR4hq9vS9pc8RP	Get hash	malicious	Unknown	Browse
	division.exe	Get hash	malicious	Blank Grabber	Browse
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse
	Infection Scanner.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	http://discord.objl.net/	Get hash	malicious	Unknown	Browse
	ZK9XFb424l.exe	Get hash	malicious	Python Stealer, Creal Stealer, XWorm	Browse
	8Zi7xnKKw7.exe	Get hash	malicious	Python Stealer, DCRat, Discord Token Stealer, Empyrean	Browse
	http://mj.xiaob.ai/	Get hash	malicious	Unknown	Browse
	windisc.exe	Get hash	malicious	Discord Token Stealer	Browse
151.80.29.83	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse
	TS-240609-CStealer1.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	ZK9XFb424l.exe	Get hash	malicious	Python Stealer, Creal Stealer, XWorm	Browse
	boost.exe	Get hash	malicious	NovaSentinel	Browse
	https://gofile.io/d/rrVkK9	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse
	wild_installer.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse
159.89.102.253	23eb97f4-980c-745d-c5e2-6fdb70189e48.eml	Get hash	malicious	HTMLPhisher	Browse
	http://texadasoftware.com	Get hash	malicious	Unknown	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE .xlsx	Get hash	malicious	HTMLPhisher	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE .xlsx	Get hash	malicious	HTMLPhisher	Browse
	https://sorjon.com	Get hash	malicious	Unknown	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse
	TS-240617-UF1.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
172.67.74.152	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	http://review-page-violation-issue-meta-center.vercel.app/	Get hash	malicious	Unknown	Browse	138.197.235.123
	https://request-remove-violation-here.surge.sh/next.html	Get hash	malicious	Unknown	Browse	138.68.112.220
	http://cacahs.fdavm.com/	Get hash	malicious	Unknown	Browse	64.227.29.131
	https://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDA	Get hash	malicious	Unknown	Browse	45.55.112.74
	http://multichaindappsx.pages.dev/	Get hash	malicious	Unknown	Browse	142.93.100.104
	https://www.newschoolers.com/click?news=50302&u=http://t.email1.gct.com/r/?id=hfffbb46%2Cc90b147%2Cc90b14f%26jobcode=739-0055%26omtr_camp=em%3ACORP%3APREN%3ASPROD%3A268417862%3Agcc_DM212754%3A739-0055%26lpg=xcBOkfEbudlaXz7yNVldPQ%3D%3D%26cid=gcc_DM212754%26bid=268417862%26rid=1061475%26p1=%41%4E%54oniopneus.com.br/dayo/uevcx/captcha/bWF0cy5hcnRodXJzc29uQHF1aWx0ZXJjaGV2aW90LmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	134.209.234.126
	https://app.freelo.io/public/shared-link-view/?a=7d4bf6664acd2b6680f919451ab74732&b=bfcc7360a8233953847f77d79d4988e2	Get hash	malicious	Unknown	Browse	134.209.238.18
	OCSM1XFiPg.elf	Get hash	malicious	Unknown	Browse	209.97.186.118
	addvXQnjp3.elf	Get hash	malicious	Unknown	Browse	167.99.231.7
	https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/a0h4f/captcha/ci5zbGllc3RlckBiYXMuYWMudWs=$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	134.209.234.126
CLOUDFLARENETUS	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.124.96
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.123.96
	c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	6xmBUtHylU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OVER DUE INVOICE PAYMENT.docx	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AW0S.sdscondo.com/index.xml%23?email=cGV0ZXIuYnJvd24yM0Bxci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://rb.gy/zsqpja	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	188.114.97.3
OVHFR	https://nmg.evlink21.net/	Get hash	malicious	Unknown	Browse	51.89.9.254
	SecuriteInfo.com.Trojan.AutoIt.1410.29083.29061.exe	Get hash	malicious	Stealerium	Browse	51.38.43.18
	ck4L513fGM.elf	Get hash	malicious	Unknown	Browse	51.89.177.162
	er8xK60DM8.elf	Get hash	malicious	Unknown	Browse	54.38.100.30
	http://euroinmersion.com	Get hash	malicious	Unknown	Browse	178.33.162.219
	file.exe	Get hash	malicious	SmokeLoader	Browse	137.74.196.132
	VXBKak29Dz.elf	Get hash	malicious	Mirai	Browse	8.18.211.14
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	137.74.196.132
	Encrypted Doc-[izO-3902181].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse	149.56.200.84
RANATECHNET-AFRANATechnologiesKabulAF	https://www.pxfuel.com/	Get hash	malicious	Unknown	Browse	121.127.42.98
	https://www.msn.com/en-us/weather/forecast/in-Des-Moines,IA?loc=eyJsIjoiRGVzIE1vaW5lcyIsInIiOiJJQSIsImMiOiJVbml0ZWQgU3RhdGVzIiwiaSI6IlVTIiwidCI6MSwiZyI6ImVuLXVzIiwieCI6Ii05My42MjAzMzg0Mzk5NDE0IiwieSI6IjQxLjU4ODc5MDg5MzU1NDY5In0%3D&weadegreetype=F	Get hash	malicious	Unknown	Browse	121.127.42.98
	https://lanecain-homes.com/	Get hash	malicious	Unknown	Browse	121.127.42.98
	http://belastingdienst-betalingportaal.info	Get hash	malicious	Unknown	Browse	121.127.45.81
CLOUDFLARENETUS	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.124.96
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	104.16.123.96
	c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	6xmBUtHylU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OVER DUE INVOICE PAYMENT.docx	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AW0S.sdscondo.com/index.xml%23?email=cGV0ZXIuYnJvd24yM0Bxci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://rb.gy/zsqpja	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	188.114.97.3

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_Salsa20.pyd	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe	Get hash	malicious	BazaLoader	Browse
	Wetransfer.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.FileRepMalware.10144.24483.exe	Get hash	malicious	Discord Token Stealer	Browse
	SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Agent-LZ.32136.12177.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Agent-LZ.23397.22787.exe	Get hash	malicious	Unknown	Browse
	Mupid_project.xls	Get hash	malicious	Unknown	Browse
	Caffeine AIO [V7.0].exe	Get hash	malicious	Python Stealer	Browse
C:\Users\user\AppData\Local\Temp\onefile_2444_133646285062301735\Crypto\Cipher\_raw_aes.pyd	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe	Get hash	malicious	BazaLoader	Browse
	Wetransfer.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.FileRepMalware.10144.24483.exe	Get hash	malicious	Discord Token Stealer	Browse
	SecuriteInfo.com.W64.S-e4cd4610.Eldorado.25276.12705.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Agent-LZ.32136.12177.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Agent-LZ.23397.22787.exe	Get hash	malicious	Unknown	Browse
	Mupid_project.xls	Get hash	malicious	Unknown	Browse
	Caffeine AIO [V7.0].exe	Get hash	malicious	Python Stealer	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........