Malware Analysis Report

2024-11-30 19:48

Sample ID 220128-wak8fahgg5
Target 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335
SHA256 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335
Tags
rms rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335

Threat Level: Known bad

The file 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335 was found to be: Known bad.

Malicious Activity Summary

rms rat trojan

RMS

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 17:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 17:43

Reported

2022-01-28 17:52

Platform

win7-en-20211208

Max time kernel

156s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

RMS

trojan rat rms

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1448 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 832 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1048 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1372 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1096 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 828 wrote to memory of 856 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 856 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 856 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe

"C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\

C:\Windows\SysWOW64\xcopy.exe

xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf"

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe -second

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe /tray /user

Network

Country Destination Domain Proto
US 8.8.8.8:53 rutils.com udp
US 34.102.136.180:80 rutils.com tcp
US 34.102.136.180:80 rutils.com tcp
US 8.8.8.8:53 server.rutils.com udp
US 209.205.218.178:5655 server.rutils.com tcp

Files

memory/1448-54-0x0000000076421000-0x0000000076423000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.ldr

MD5 8ee5ab32edced6eb38819b7674bfb0cd
SHA1 030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256 a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA512 82f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9

\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.dat

MD5 abdbcc091c67fd748cbbf0bf257f6712
SHA1 8f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256 821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA512 9a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa

memory/1372-69-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-71-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-70-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-68-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-67-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-66-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1372-72-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

memory/1372-75-0x0000000000400000-0x000000000041E000-memory.dmp

memory/832-77-0x0000000000290000-0x0000000000291000-memory.dmp

memory/1372-78-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stg.cfg

MD5 ba9dbe65381759bb06d3dc6a2d0089c8
SHA1 37a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256 ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA512 2471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmmon.dll

MD5 42bb69a180bf12f972d10aed9ce02861
SHA1 c2f9ffdf518da9e037f76902746de89c2e2821e8
SHA256 9086824882cd7c64e3d43a6597e657c5f0290dfcacffc3d0f1faba15a61761ba
SHA512 5ccbb47a79d3372c3edf074d09e82d7fce149cdaaa7f5b615226c247628b5fccec9980c44642ef36738b05f706f15984a4dd984b156fb103af2a20ff63917013

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf

MD5 69e8ec9bdccd6ed33fcad2fa19602b2f
SHA1 9f48e109675cdb0a53400358c27853db48fcd156
SHA256 cff2de4c828e78febfb2eb8b4780092d395016608b641e126e67e27058415759
SHA512 b22b948aec9b58dca27481e5d638dd53c99e4f9ed4f7f2270ae1a60b36567ac9c02635d33e528d82dd77157e62107616bba199cf6f34078bd1ecdb7ebe424773

C:\Users\Admin\AppData\Local\Temp\RarSFX0\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

C:\Users\Admin\AppData\Local\Temp\RarSFX0\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.ldr

MD5 8ee5ab32edced6eb38819b7674bfb0cd
SHA1 030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256 a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA512 82f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.dat

MD5 abdbcc091c67fd748cbbf0bf257f6712
SHA1 8f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256 821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA512 9a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\stg.cfg

MD5 ba9dbe65381759bb06d3dc6a2d0089c8
SHA1 37a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256 ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA512 2471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf

memory/1396-106-0x00000000026E0000-0x00000000026E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

memory/556-119-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

memory/240-122-0x00000000003D0000-0x00000000003D1000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

memory/1640-127-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 17:43

Reported

2022-01-28 17:52

Platform

win10-en-20211208

Max time kernel

163s

Max time network

166s

Command Line

C:\Windows\Explorer.EXE

Signatures

RMS

trojan rat rms

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\symbols\exe\rutserv.pdb C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
File opened for modification C:\Windows\SysWOW64\rutserv.pdb C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
File opened for modification C:\Windows\SysWOW64\exe\rutserv.pdb C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2700 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 2700 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 2700 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 856 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
PID 1248 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 952 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 952 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 952 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 1248 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 3864 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 3864 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 3864 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 4004 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
PID 1472 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe C:\Windows\Explorer.EXE
PID 2244 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe
PID 2244 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe
PID 2300 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe C:\Windows\Explorer.EXE
PID 2700 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 2700 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 2700 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1704 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
PID 1704 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
PID 1704 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
PID 1876 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe
PID 1876 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe
PID 1876 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe
PID 3924 wrote to memory of 1636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3924 wrote to memory of 1636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3924 wrote to memory of 1636 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1636 wrote to memory of 500 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe

"C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\

C:\Windows\SysWOW64\xcopy.exe

xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf"

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe -second

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe /tray /user

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE527B30026B53EC390722A009D1DEC9 --mojo-platform-channel-handle=1668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=39FA7DE360766BAF9A2E6D46B9727979 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=39FA7DE360766BAF9A2E6D46B9727979 --renderer-client-id=2 --mojo-platform-channel-handle=1676 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E79A63EE1615DA96F4864A6FCAA44C7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E79A63EE1615DA96F4864A6FCAA44C7 --renderer-client-id=4 --mojo-platform-channel-handle=2100 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2195C8F0E5B216855608C6B52890141A --mojo-platform-channel-handle=2512 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E46BF4AE82C7A9A6A394FD7F9A6FD9FA --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF7D38A154D96D23EE8E12E3C020BAB7 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 rutils.com udp
US 34.102.136.180:80 rutils.com tcp
US 34.102.136.180:80 rutils.com tcp
US 8.8.8.8:53 server.rutils.com udp
US 209.205.218.178:5655 server.rutils.com tcp
US 52.109.8.20:443 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.ldr

MD5 8ee5ab32edced6eb38819b7674bfb0cd
SHA1 030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256 a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA512 82f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.dat

MD5 abdbcc091c67fd748cbbf0bf257f6712
SHA1 8f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256 821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA512 9a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa

memory/856-202-0x0000000000470000-0x0000000000471000-memory.dmp

memory/1248-203-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

memory/1248-205-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stg.cfg

MD5 ba9dbe65381759bb06d3dc6a2d0089c8
SHA1 37a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256 ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA512 2471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf

MD5 69e8ec9bdccd6ed33fcad2fa19602b2f
SHA1 9f48e109675cdb0a53400358c27853db48fcd156
SHA256 cff2de4c828e78febfb2eb8b4780092d395016608b641e126e67e27058415759
SHA512 b22b948aec9b58dca27481e5d638dd53c99e4f9ed4f7f2270ae1a60b36567ac9c02635d33e528d82dd77157e62107616bba199cf6f34078bd1ecdb7ebe424773

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmmon.dll

MD5 42bb69a180bf12f972d10aed9ce02861
SHA1 c2f9ffdf518da9e037f76902746de89c2e2821e8
SHA256 9086824882cd7c64e3d43a6597e657c5f0290dfcacffc3d0f1faba15a61761ba
SHA512 5ccbb47a79d3372c3edf074d09e82d7fce149cdaaa7f5b615226c247628b5fccec9980c44642ef36738b05f706f15984a4dd984b156fb103af2a20ff63917013

C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

C:\Users\Admin\AppData\Local\Temp\RarSFX0\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

C:\Users\Admin\AppData\Local\Temp\RarSFX0\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

memory/1248-213-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.ldr

MD5 8ee5ab32edced6eb38819b7674bfb0cd
SHA1 030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256 a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA512 82f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.dat

MD5 abdbcc091c67fd748cbbf0bf257f6712
SHA1 8f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256 821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA512 9a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe

MD5 aff05aa5f2c03cb85b7c854a5d682d60
SHA1 e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256 a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512 016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\stg.cfg

MD5 ba9dbe65381759bb06d3dc6a2d0089c8
SHA1 37a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256 ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA512 2471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf

memory/1472-221-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1472-223-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe

MD5 df73a0ee624fa95fb96a4125c15c0420
SHA1 a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256 e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA512 1d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winmmon64.dll

MD5 cfcdf13096177dd4ae41cba719a41a8f
SHA1 a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256 be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA512 8fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

memory/2784-234-0x0000000000B60000-0x0000000000B61000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe

MD5 2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1 e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA256 38bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA512 2911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5

memory/1876-236-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe

MD5 ab1e92ef682a01e3ff9c98497f5b8972
SHA1 400438eb302886fd064274188647e6653e455eed
SHA256 33beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512 526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00

memory/1928-239-0x00007FFDB2F40000-0x00007FFDB2F41000-memory.dmp

memory/3176-240-0x0000000000B00000-0x0000000000B01000-memory.dmp

memory/500-241-0x0000000077582000-0x0000000077583000-memory.dmp

memory/1012-244-0x0000000077582000-0x0000000077583000-memory.dmp

memory/3552-249-0x0000000077582000-0x0000000077583000-memory.dmp

memory/1592-254-0x0000000077582000-0x0000000077583000-memory.dmp

memory/1620-257-0x0000000077582000-0x0000000077583000-memory.dmp

memory/3724-260-0x0000000077582000-0x0000000077583000-memory.dmp

\??\PIPE\RManFUSCallbackNotify32

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e