Adware.OpenSUpdater.LC

The detection of Adware.OpenSUpdater.LC on your system indicates the presence of a potentially unwanted program that may be displaying unwanted advertisements or collecting user data without consent. Adware programs like this one can be frustrating and potentially harmful to your online security and privacy. In this report, we will provide an overview of what Adware.OpenSUpdater.LC is, how it operates, and the symptoms you may experience if your system is infected.

What Is Adware.OpenSUpdater.LC?

Adware.OpenSUpdater.LC is a type of adware program that is designed to display unwanted advertisements on your computer or mobile device. Adware programs like this one can be installed on your system without your knowledge or consent, often through bundled software downloads or malicious websites. Once installed, adware programs can collect user data, display pop-up ads, and redirect your browser to unwanted websites.

How Adware.OpenSUpdater.LC Operates

Adware.OpenSUpdater.LC operates by installing itself on your system and then connecting to a remote server to download and display advertisements. These advertisements can be in the form of pop-up windows, banners, or sponsored search results. Adware programs like this one can also collect user data, such as browsing history and search queries, to deliver targeted advertisements. In some cases, adware programs can also install additional malware or potentially unwanted programs on your system.

Symptoms of Infection

If your system is infected with Adware.OpenSUpdater.LC, you may experience a range of symptoms, including unwanted pop-up advertisements, slow system performance, and unexpected browser redirects. You may also notice that your browser homepage or search engine has been changed without your consent. In some cases, adware programs can also cause system crashes or freezes, particularly if they are consuming system resources to display advertisements.

• Unwanted pop-up advertisements
• Slow system performance
• Unexpected browser redirects
• Changed browser homepage or search engine
• System crashes or freezes

How to Remove Adware.OpenSUpdater.LC

1. Boot your system in Safe Mode with Networking to prevent the adware program from loading.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove the adware program.
3. Uninstall any suspicious programs that may be related to the adware infection.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by the adware program.
5. Reboot your system and perform a follow-up scan to ensure that the adware program has been completely removed.

Conclusion

Removing Adware.OpenSUpdater.LC from your system requires a combination of technical expertise and caution. By following the steps outlined in this report, you can help to ensure that your system is free from the adware program and any related malware. It is also important to take steps to prevent future adware infections, such as avoiding suspicious downloads and websites, and using reputable anti-malware software to protect your system. Remember to always be cautious when clicking on links or downloading software from the internet, and never install programs that you do not trust.

Analysis Report

General information

Family Name:	Adware.OpenSUpdater.LC
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 3321edd6307ebe08f27e31abbf6c0e81 SHA1: e6545a92470c53524442c9593f36d079f6c0e1eb SHA256: 307782D3A38E434BC13306FE6591262C1C4D149A1E9DB80DF094FAD0CC0ECAD1 File Size: 4.88 MB, 4877536 bytes

MD5: e30eebe19be03f1f548868e6eb486871 SHA1: e09b1bf4a44d5a694903bd648b33ebd3365fcca8 SHA256: 49545FD8150DB05E6D0428490D8C8E098B81BB495BCA6CFF5145E142D78E4977 File Size: 1.11 MB, 1110162 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	EaseNet Mellifluous Company 网之易
File Description	OneMellifluousUpdater Warcraft official Gaming Platform Installation Programs 魔兽争霸官方对战平台安装程序
File Version	1.8.70.8597 1.0.0.0
Legal Copyright	Copyright (C) 2015 EaseNet. All rights reserved Copyright (C) 2015 网之易。保留所有权利 © Mellifluous Company 2020
Product Name	OneMellifluousUpdater Warcraft III Battle Platform 魔兽争霸官方对战平台
Product Version	1.8.70.8597 1.0.0.0[5/23/2020.18:51:04]

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
OneMellifluousUpdaterCode	OneMellifluousUpdaterCode	Root Not Trusted

File Traits

• dll
• HighEntropy
• imgui
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\nsga81a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nshaa8c.tmp\langdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_check.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_combox.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_combox_drop.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_install_big.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_install_input.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_install_medium1.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_install_medium2.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_install_small.png	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_login_logo_normal.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_login_logo_normal_en.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_process_bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_process_front.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\btn_title_line.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_agree_scrollbar.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_agree_scrollbar2.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_bg2.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_bg_frame.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_close.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\dlg_min.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\exit_install.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\install_finished.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\install_finished_en.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\logo.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\image\pic_title_bg.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\license\license_cn.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\license\license_en.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\sys.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\trans\lang_cn.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\uires.idx	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\dlg_main.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\init.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_agree.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_exit.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_finish.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_folder.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_installing.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_ins_start.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_unins_finish.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_unins_start.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nshaa8c.tmp\uires\xml\page_unins_uninstalling.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk38ee.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsp37d5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsraa7b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Uk ~�B �� �v�� 7� �� �� �T�B������% Bx�< �! #�� $��%� &� '�! (�(X�(� ) ; *J*9 *�" ,=�1�1HO5,]5�G>��@V�@�* A��B F Fy�G�IH[uH�pM�lN$ N�P@jR��X�_�zb"hc�we0T e�hh�rj�bk`k�qq(	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Xqncadgk\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\

"C:\Users\Dtttsnlw\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\