What is check-update.exe?
check-update.exe is part of Updater and developed by Aller Media e.K. according to the check-update.exe version information.
check-update.exe's description is "Updater"
check-update.exe is digitally signed by Aller Media e.K..
check-update.exe is usually located in the 'C:\ProgramData\Updater\' folder.
Some of the anti-virus scanners at VirusTotal detected check-update.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on check-update.exe:
| Property | Value |
|---|---|
| Product name | Updater |
| Company name | Aller Media e.K. |
| File description | Updater |
| Original filename | Setup.EXE |
| Comments | Updater |
| Legal copyright | Aller Media e.K. |
| Product version | 1,0 |
| File version | 2. 4. 500. 0 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | Updater |
| Company name | Aller Media e.K. |
| File description | Updater |
| Original filename | Setup.EXE |
| Comments | Updater |
| Legal copyright | Aller Media e.K. |
| Product version | 1,0 |
| File version | 2. 4. 500. 0 |
Digital signatures [?]
check-update.exe has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | Aller Media e.K. |
| Certificate issuer name | GlobalSign Extended Validation CodeSigning CA - SHA256 - G3 |
| Certificate serial number | 08f8e0dc1bafb839e703290a |
VirusTotal report
2 of the 70 anti-virus programs at VirusTotal detected the check-update.exe file. That's a 3% detection rate.
| Scanner | Detection Name |
|---|---|
| VBA32 | BScope.Trojan.Download |
| Webroot | W64.Trojan.Gen |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2"
],
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileTracingMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileDirectory"
],
"dll_loaded": [
"C:\\Windows\\System32\\mswsock.dll",
"urlmon.dll",
"DNSAPI.dll",
"kernel32.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Ext.dll",
"C:\\Windows\\system32\\napinsp.dll",
"API-MS-WIN-Service-Management-L1-1-0.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"WININET.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"OLEAUT32.DLL",
"RASMAN.DLL",
"IPHLPAPI.DLL",
"ole32.dll",
"COMCTL32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"API-MS-WIN-Service-winsvc-L1-1-0.dll",
"rtutils.dll",
"shdocvw.dll",
"WININET.DLL",
"wininet.dll",
"ADVAPI32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\pnrpnsp.dll",
"DHCPCSVC.DLL",
"C:\\Windows\\System32\\winrnr.dll",
"CLBCatQ.DLL",
"comctl32.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"SETUPAPI.dll",
"msi.dll",
"RICHED20.DLL",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"shell32.dll",
"rpcrt4.dll",
"COMCTL32.DLL",
"WS2_32.dll",
"ICMP.DLL"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe\" ",
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat\" ",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"connects_host": [
"update.am.de"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\udt_RASMANCS",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\udt.exe",
"HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.XMLDOM\\CLSID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_CURRENT_USER\\Microsoft.XMLDOM",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
"HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\udt.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\Progid",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
"HKEY_CURRENT_USER\\software",
"HKEY_CURRENT_USER\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\TreatAs",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
"HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\FileSystem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler"
],
"resolves_host": [
"update.am.de",
"wpad",
"cuckpc"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT2.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"directory_removed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0"
],
"file_exists": [
"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Ext.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\http:\\update.am.de\\version.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat\"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\tray.ico"
],
"mutex": [
"IESQMMUTEX_0_208",
"_UDT_Update_Download_Tool_",
"am.de-OPIF-SNUX-QCOD-TV9F-WW50-ISJ57"
],
"file_failed": [
"C:\\Windows\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\E01",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MPIC.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A6",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A7"
],
"guid": [
"{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
"{a47979d2-c419-11d9-a5b4-001185ad2b89}",
"{00000000-0000-0000-c000-000000000046}",
"{d0074ffd-570f-4a9b-8d69-199fdba5723b}",
"{2933bf90-7b36-11d2-b20e-00c04f983e60}",
"{dcb00000-570f-4a9b-8d69-199fdba5723b}"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\ConsoleTracingMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\FileTracingMask",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\NoBetaVersions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\SaferFlags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\ProxyType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\TimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\DefaultLevel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\ConsoleTracingMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\PolicyScope",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\DefaultDLServer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\FileSystem\\Win31FileSystem",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Srp\\GP\\RuleCount",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\Levels",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\TestConnection",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\LogFileName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.XMLDOM\\CLSID\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\ProxyHTTP",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadExpirationDays",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun"
],
"directory_enumerated": [
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.*",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users",
"C:\\Windows\\System32\\ras\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\"
]
}Dropped
[
{
"yara": [],
"sha1": "ecd8a820d022dfd12590551e68087048e5715c59",
"name": "2264acac265e8eef_udt.exe.manifest",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest",
"type": "XML 1.0 document, ASCII text, with CRLF line terminators",
"sha256": "2264acac265e8eef34a7d37e18292a1550ab346fdfcc9f5a262e6a2c59ac4cd6",
"urls": [],
"crc32": "DAB52ED5",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/2264acac265e8eef_udt.exe.manifest",
"ssdeep": null,
"size": 1342,
"sha512": "4ae91136fa3a53eb38b9fec4eaf1c6e2c540e462a61c4751793d4bb21e113d8a554d5e954d363cf773b4aa69ad1b160802842eb0fc706b79227ac916d740347d",
"pids": [],
"md5": "ae6a394fcd53586b0875f4b40cc511bc"
},
{
"yara": [],
"sha1": "843acf0543c6c56bb8a9ef771d581cd4313a0066",
"name": "57077bf3f606e975_udt.log",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"type": "ASCII text, with CRLF line terminators",
"sha256": "57077bf3f606e975ee6bcc01a069b0a4c2037ea53b4455bfbe1ee43f700195b2",
"urls": [
"http:\/\/update.am.de\/\/"
],
"crc32": "6FD230CB",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/57077bf3f606e975_udt.log",
"ssdeep": null,
"size": 444,
"sha512": "8e8f10a33ce06377fc041f5458537e0960658461b0cf976e396e413fe536fb6043877047c13653464b1395962b24cf9de7cd850396cb94184c1a1bc130495c05",
"pids": [
2968
],
"md5": "3f25116e4421e30ea3440ae3d24ded3a"
},
{
"yara": [],
"sha1": "7b229344b4f642fe9b7dd9c989731a8fa08c121e",
"name": "71aa9e2b8cc60ac8_config.ini",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"type": "ASCII text, with CRLF line terminators",
"sha256": "71aa9e2b8cc60ac8562bce5b61deba9eb7806512f67651551d2561612cbeb12b",
"urls": [],
"crc32": "47E89288",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/71aa9e2b8cc60ac8_config.ini",
"ssdeep": null,
"size": 429,
"sha512": "d1d92e19985012ee4e27f916476bc0b952715fa507d8f59483b83a64b1a19b87cbf3829594296dad68cfd41a4139aa03d03702e21914e934feeb790dadd542a6",
"pids": [
2740,
2968
],
"md5": "8c5f1a8b60b3c67e0be0662b2990decd"
},
{
"yara": [],
"sha1": "d92a5ac4bcd24a65ff09ae04821246ae033b4031",
"name": "e34707267db063ed_AKIDelST.bat",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"type": "ASCII text, with CRLF line terminators",
"sha256": "e34707267db063ed1d3485ad1561f41c845350597306f340106ae3640b082119",
"urls": [],
"crc32": "EC9F9D2F",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/e34707267db063ed_AKIDelST.bat",
"ssdeep": null,
"size": 852,
"sha512": "8beb69ae26b9988478aea6acc305a6c3d65d9d4ef9e78bd539202b1ed760d443464ab795c96a149fd40e8179ca83e7e3a766cc74e39279b11bf6f5e837669e3c",
"pids": [
2968,
2184
],
"md5": "1a6a51fabd912ece18a486fb04ea79b9"
},
{
"yara": [],
"sha1": "b2197bf058e4bbbae3bb8dc4a3dea4f449e8a959",
"name": "7fb83aedd630de1e_udt.exe",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"type": "PE32 executable (GUI) Intel 80386, for MS Windows",
"sha256": "7fb83aedd630de1e0c4a766837b85acd65a1b61c6a6f66ed2583caab318ecccc",
"urls": [
"http:\/\/www.winimage.com\/zLibDll"
],
"crc32": "62D11905",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/7fb83aedd630de1e_udt.exe",
"ssdeep": null,
"size": 532480,
"sha512": "3cd777907fea3eac3c2983b9d4e91b65000002b292d348fe02acca0c0369ba5c19cfcdda6704530e34aa56dc98a8f6aeed056dcc71b5a81dcd9bcf763410be17",
"pids": [],
"md5": "5b1e449fbba833d603725b82f49e26a8"
},
{
"yara": [],
"sha1": "bc2f4725132b2e5e67db813f53b277fb4b25fd4c",
"name": "2f5296c5fcc67f78_Tools.dll",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
"sha256": "2f5296c5fcc67f78cee6eadb1d87201772602f94216d19f857140e51e2f691ff",
"urls": [],
"crc32": "E92045C1",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/2f5296c5fcc67f78_Tools.dll",
"ssdeep": null,
"size": 18944,
"sha512": "987a7fd1d877cf6f0cf199fbca2a601978ac7c2d52e53c288a2544bf07b15742e694d4dd3517b0443b71a10069dc22c2d4f1506f6f21d9d0a15f4fc8231d6d9b",
"pids": [],
"md5": "c0b8010d872f15c1ff0ca8063600bc9d"
},
{
"yara": [],
"sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
"name": "e3b0c44298fc1c14_extern.xml",
"type": "empty",
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"urls": [],
"crc32": "00000000",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/e3b0c44298fc1c14_extern.xml",
"ssdeep": null,
"size": 0,
"sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
"md5": "d41d8cd98f00b204e9800998ecf8427e"
},
{
"yara": [],
"sha1": "51dc93b4a80f2c6758f4d50c1ea21f9c625be2ab",
"name": "b8d4aa8e66ad0226_udt.log",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"type": "ASCII text, with CRLF line terminators",
"sha256": "b8d4aa8e66ad0226b920e57c49656787ec8d6437f32f59d6e5fa0670fc296c0b",
"urls": [
"http:\/\/update.am.de\/\/"
],
"crc32": "E34B5AE6",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/b8d4aa8e66ad0226_udt.log",
"ssdeep": null,
"size": 328,
"sha512": "e0899e692d4b5f27d74aaa73bee2f0c76bbbd6842ec7ff4eecb56944c2f3ab9c078fde4d692d9c5e06ddd7d150d3ae0e0f0765e4a0129c7979b4b24a19a7db14",
"pids": [
2968
],
"md5": "ffd4d94b0119f24f3c4f6cca8d793751"
},
{
"yara": [],
"sha1": "8cd327d55ac604ac8f8e6f1495b65b05336dcd15",
"name": "7ad88ea8f937d542_udt.ini",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"type": "XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators",
"sha256": "7ad88ea8f937d54224ff31a06d11af90f03338302e31ba7bfc1142023ad3f43f",
"urls": [
"http:\/\/update.am.de",
"http:\/\/update.am.de\/info"
],
"crc32": "DF6C7F2A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3329\/files\/7ad88ea8f937d542_udt.ini",
"ssdeep": null,
"size": 27456,
"sha512": "23b550b905e6680093d09ebfe9002f7abfb31954b406df238f5351201f0a9ead9b9e52955056716c1c566e6f2d24f8303d6ff0cdddf753b2d7f22b62a1982250",
"pids": [],
"md5": "c1688359f3c3cc7331417943ccd02517"
}
]Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"process_name": "udt.exe",
"pid": 2968,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileTracingMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileDirectory"
],
"dll_loaded": [
"C:\\Windows\\System32\\mswsock.dll",
"urlmon.dll",
"DNSAPI.dll",
"kernel32.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Ext.dll",
"C:\\Windows\\system32\\napinsp.dll",
"API-MS-WIN-Service-Management-L1-1-0.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"WININET.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"OLEAUT32.DLL",
"RASMAN.DLL",
"IPHLPAPI.DLL",
"ole32.dll",
"COMCTL32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"API-MS-WIN-Service-winsvc-L1-1-0.dll",
"rtutils.dll",
"shdocvw.dll",
"WININET.DLL",
"wininet.dll",
"ADVAPI32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\pnrpnsp.dll",
"DHCPCSVC.DLL",
"C:\\Windows\\System32\\winrnr.dll",
"CLBCatQ.DLL",
"comctl32.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"SETUPAPI.dll",
"msi.dll",
"RICHED20.DLL",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"shell32.dll",
"COMCTL32.DLL",
"WS2_32.dll",
"ICMP.DLL"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat\" ",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"connects_host": [
"update.am.de"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\udt_RASMANCS",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\udt.exe",
"HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.XMLDOM\\CLSID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_CURRENT_USER\\Microsoft.XMLDOM",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
"HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\udt.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\Progid",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
"HKEY_CURRENT_USER\\software",
"HKEY_CURRENT_USER\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InprocHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\TreatAs",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
"HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\FileSystem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler"
],
"resolves_host": [
"update.am.de",
"wpad",
"cuckpc"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT2.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"file_exists": [
"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\http:\\update.am.de\\version.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\udt.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\extern.xml",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Ext.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\tray.ico"
],
"mutex": [
"IESQMMUTEX_0_208",
"_UDT_Update_Download_Tool_",
"am.de-OPIF-SNUX-QCOD-TV9F-WW50-ISJ57"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MPIC.ini",
"C:\\Windows\\"
],
"guid": [
"{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
"{a47979d2-c419-11d9-a5b4-001185ad2b89}",
"{00000000-0000-0000-c000-000000000046}",
"{d0074ffd-570f-4a9b-8d69-199fdba5723b}",
"{2933bf90-7b36-11d2-b20e-00c04f983e60}",
"{dcb00000-570f-4a9b-8d69-199fdba5723b}"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\ProxyType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileTracingMask",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\TimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\ThreadingModel",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\ProgID\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\DefaultDLServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Microsoft.XMLDOM\\CLSID\\(Default)",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\NoBetaVersions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\FileSystem\\Win31FileSystem",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\ProxyHTTP",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Domain",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{2933BF90-7B36-11D2-B20E-00C04F983E60}\\InProcServer32\\InprocServer32",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadExpirationDays",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASMANCS\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\udt_RASAPI32\\ConsoleTracingMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_CURRENT_USER\\Software\\UpdateDownloadTool\\FBDHAGGAGAKGNHGBNHCA\\Settings\\TestConnection",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)"
],
"directory_enumerated": [
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.*",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Windows\\System32\\ras\\*.pbk"
]
},
"first_seen": 1572972788.0156,
"ppid": 2740
},
{
"process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
"process_name": "cmd.exe",
"pid": 2184,
"summary": {
"dll_loaded": [
"ADVAPI32.dll"
],
"file_opened": [
"C:\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"directory_removed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat\"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\LogFileName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\DefaultLevel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\SaferFlags",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\PolicyScope",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Srp\\GP\\RuleCount",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\Levels",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest"
]
},
"first_seen": 1572972791.8516,
"ppid": 2968
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"process_name": "bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"pid": 2740,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\"
],
"dll_loaded": [
"rpcrt4.dll",
"kernel32.dll",
"SETUPAPI.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll"
],
"file_opened": [
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe"
],
"directory_removed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A0",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A1",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\E01",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A6",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A7"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe\" ",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\config.ini"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName"
]
},
"first_seen": 1572972787.6719,
"ppid": 1664
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1572972787.3438,
"ppid": 376
}
]Signatures
[
{
"markcount": 45,
"families": [],
"description": "Command line console output was observed",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 193
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 195
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 197
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 231
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 233
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 235
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Could Not Find C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe.manifest\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 253
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 269
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 271
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9766,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 273
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Could Not Find C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\A2?\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 288
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 304
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 306
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 308
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Could Not Find C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\*.ini\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 324
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 338
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 340
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 342
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Could Not Find C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 356
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 370
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 372
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 374
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Could Not Find C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 388
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 402
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "if ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 404
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "exist \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 406
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "goto",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 408
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " Repeat ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 410
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 427
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "if ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 429
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "exist \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll\" ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 431
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "goto",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 433
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " Repeat ",
"console_handle": "0x00000007"
},
"time": 1572972791.9916,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 435
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 452
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "if ",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 454
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "exist \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\st.exe\" ",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 456
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "goto",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 458
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " Repeat ",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 460
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 477
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "rmdir",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 479
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\" ",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 481
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 497
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "del",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 499
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": " \"C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat\" ",
"console_handle": "0x00000007"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 501
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "The batch file cannot be found.\r\n",
"console_handle": "0x0000000b"
},
"time": 1572972792.0076,
"tid": 2648,
"flags": {}
},
"pid": 2184,
"type": "call",
"cid": 520
}
],
"references": [],
"name": "console_output"
},
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1572972787.8909,
"tid": 2336,
"flags": {}
},
"pid": 2740,
"type": "call",
"cid": 933
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 1,
"families": [],
"description": "The executable uses a known packer",
"severity": 1,
"marks": [
{
"category": "packer",
"ioc": "Armadillo v1.71",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "peid_packer"
},
{
"markcount": 2,
"families": [],
"description": "Drops a binary and executes it",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "dropper"
},
{
"markcount": 2,
"families": [],
"description": "Drops an executable to the user AppData folder",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\udt.exe",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\UDT-FBDHAGGAGAKGNHGBNHCA0\\Tools.dll",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "exe_appdata"
},
{
"markcount": 1,
"families": [],
"description": "A process created a hidden window",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "ShellExecuteExW",
"return_value": 1,
"arguments": {
"parameters": "",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"filepath_r": "C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"show_type": 0
},
"time": 1572972791.7806,
"tid": 2588,
"flags": {}
},
"pid": 2968,
"type": "call",
"cid": 1440
}
],
"references": [],
"name": "stealth_window"
},
{
"markcount": 1,
"families": [],
"description": "Checks adapter addresses which can be used to detect virtual network interfaces",
"severity": 2,
"marks": [
{
"call": {
"category": "network",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "GetAdaptersAddresses",
"return_value": 111,
"arguments": {
"flags": 0,
"family": 0
},
"time": 1572972788.3276,
"tid": 344,
"flags": {}
},
"pid": 2968,
"type": "call",
"cid": 1078
}
],
"references": [],
"name": "antivm_network_adapters"
},
{
"markcount": 1,
"families": [],
"description": "Deletes executed files from disk",
"severity": 3,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\AKIDelST.bat",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "deletes_executed_files"
},
{
"markcount": 5,
"families": [],
"description": "Sets or modifies WPAD proxy autoconfiguration file for traffic interception",
"severity": 3,
"marks": [
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000384",
"value": 1,
"regkey_r": "WpadDecisionReason",
"reg_type": 4,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason"
},
"time": 1572972788.6556,
"tid": 344,
"flags": {
"reg_type": "REG_DWORD"
}
},
"pid": 2968,
"type": "call",
"cid": 1106
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000384",
"value": "\u0000\u00cba\u00da\u000f\u0094\u00d5\u0001",
"regkey_r": "WpadDecisionTime",
"reg_type": 3,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime"
},
"time": 1572972788.6556,
"tid": 344,
"flags": {
"reg_type": "REG_BINARY"
}
},
"pid": 2968,
"type": "call",
"cid": 1107
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000384",
"value": 3,
"regkey_r": "WpadDecision",
"reg_type": 4,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision"
},
"time": 1572972788.6556,
"tid": 344,
"flags": {
"reg_type": "REG_DWORD"
}
},
"pid": 2968,
"type": "call",
"cid": 1108
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExW",
"return_value": 0,
"arguments": {
"key_handle": "0x00000384",
"value": "Unidentified network",
"regkey_r": "WpadNetworkName",
"reg_type": 1,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName"
},
"time": 1572972788.6556,
"tid": 344,
"flags": {
"reg_type": "REG_SZ"
}
},
"pid": 2968,
"type": "call",
"cid": 1109
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExW",
"return_value": 0,
"arguments": {
"key_handle": "0x00000380",
"value": "{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"regkey_r": "WpadLastNetwork",
"reg_type": 1,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork"
},
"time": 1572972788.6716,
"tid": 344,
"flags": {
"reg_type": "REG_SZ"
}
},
"pid": 2968,
"type": "call",
"cid": 1178
}
],
"references": [],
"name": "modifies_proxy_wpad"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.0759449005127,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6082,
"time": 2.5302839279175,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6402,
"time": 1.0191240310669,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6730,
"time": 3.0237500667572,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7058,
"time": 1.5186409950256,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7386,
"time": -0.10047101974487,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7714,
"time": 3.0370268821716,
"dport": 5355,
"sport": 55880
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8042,
"time": 1.5476250648499,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 23194,
"time": 1.0567719936371,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 31578,
"time": 3.1259648799896,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "746457363c99ad7c2f0a3e1814a9e687da0ff925aa06624e54d20029ff80d16b",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "a793a5bb42f7c0e0d80cc22f0a0145b4d5307056185b1e93fde8ab54e4e815f3",
"irc": [],
"https_ex": []
}Screenshots
check-update.exe removal instructions
The instructions below shows how to remove check-update.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the check-update.exe file for removal, restart your computer and scan it again to verify that check-update.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate check-update.exe in the scan result and tick the checkbox next to the check-update.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate check-update.exe in the scan result.
C:\ProgramData\Updater\check-update.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the check-update.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If check-update.exe still remains in the scan result, proceed with the next step. If check-update.exe is gone from the scan result you're done.
- If check-update.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that check-update.exe no longer appear in the scan result.
Other files also named check-update.exe
check-update.exe (4 votes)
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 6dae4ebb66dc2a5b1f9d14b4aa8787ba |
| SHA256 | bfc9f2e5d39f869702f7a080be369699264cb82a65ff6c39c1f6951d294a8687 |
Error Messages
These are some of the error messages that can appear related to check-update.exe:
check-update.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
check-update.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
Updater has stopped working.
End Program - check-update.exe. This program is not responding.
check-update.exe is not a valid Win32 application.
check-update.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with the file?
To help other users, please let us know what you will do with the file:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.