Malware Analysis Report

2024-11-30 19:51

Sample ID 220129-c8s66abff4
Target b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907
SHA256 b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907
Tags
rms evasion rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907

Threat Level: Known bad

The file b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907 was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan

RMS

Executes dropped EXE

Sets file to hidden

Loads dropped DLL

Drops file in Program Files directory

Enumerates physical storage devices

Runs .reg file with regedit

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Kills process with taskkill

Suspicious behavior: SetClipboardViewer

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-29 02:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-29 02:45

Reported

2022-01-29 02:53

Platform

win7-en-20211208

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\System\RWLN.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmvorbisencoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmvorbisencoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\svshost.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\English.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\RIPCServer.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files (x86)\System\English.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\EULA.rtf C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\RIPCServer.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\Russian.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmmux.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmvorbisdecoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmvorbisdecoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\upgradewin.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_259386559 C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\RWLN.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\EULA.rtf C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files (x86)\System\Russian.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmmux.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\upgradewin.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\svshost.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\upgradewin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 1396 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 516 wrote to memory of 1484 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1484 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe

"C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files (x86)\System\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im svnhost.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systemsmss.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im svshost.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im upgradewin.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im updated.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systemswin.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systems.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systeminfo.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\System Corporation Update" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Program Files (x86)\System\svshost.exe

svshost.exe /silentinstall

C:\Program Files (x86)\System\svshost.exe

svshost.exe /firewall

C:\Program Files (x86)\System\svshost.exe

svshost.exe /start

C:\Program Files (x86)\System\svshost.exe

"C:\Program Files (x86)\System\svshost.exe"

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe"

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe" /tray

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Program Files (x86)\System" /S /D

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1396-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

C:\Program Files (x86)\System\install.vbs

MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

C:\Program Files (x86)\System\install.bat

MD5 140328806c4c3382b7ef19c64e19ebdc
SHA1 1d2871a5b4b8ee91a25c5ca588017b4bc8700fdf
SHA256 c6ae7f68183dd7d7a864f74005f63e6dffc2c7a21caba6aafd3dff574b1e6d46
SHA512 d64d8b8c89f21cbcc1dbb2e3f652d7d8925c63f952256ac201b0558d05b205db325e74e13d79a5bb675c972adf7944795efd28e9b7cc5b75ddb0081a016a1fc8

C:\Program Files (x86)\System\regedit.reg

MD5 fe6dd859d52909db41dd9a550b659b95
SHA1 72bda6b444e61dfff1aab067664b997720155ad0
SHA256 b0a478398227b17133dc674eb4562476f1400b7dfa56cffa8b960c98321be650
SHA512 ee553ae1dd6ad7351c87b603dce1830b53d517c637222ea7c46f8379a31810cd458420a719695f8484eb98fdb9bcdb856d4670d325d78791ddd5e1d5eeb1b1db

\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

memory/1584-79-0x00000000001D0000-0x00000000001D1000-memory.dmp

\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

memory/816-88-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Program Files (x86)\System\English.lg

MD5 bc25377ade68750b834c81fa71c233b8
SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

C:\Program Files (x86)\System\Russian.lg

MD5 e44e34bc285b709f08f967325d9c8be1
SHA1 e73f05c6a980ec9d006930c5343955f89579b409
SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

C:\Program Files (x86)\System\RIPCServer.dll

MD5 500b5d9c3c0ff50c9bafdccb8ee049bc
SHA1 fce3d53df1dff631e69af83420b4bf8b1c632972
SHA256 c0a5b0f80e85c2e2078feca245bfc78518988b059ea711f65b5060d4f3471838
SHA512 a624bfd524d44365a583a1ea860fcbde4188a3731e026ba23a3118857461bf8298e90ef51a23f438f9241cc5a2c5c472f47c75c8e312eb68664680c9feefbfb9

C:\Program Files (x86)\System\RWLN.dll

MD5 eba6316a7d073079954d638b335d9165
SHA1 4b75e9ae790f51077850b1da60136a182fc06425
SHA256 00e0bffd66abca71e488aa52d2672fd90d17eb25a162e3f7af46856faed2e742
SHA512 65159606e8f771edf6fb56efa6c660a173456662e8d0e92bbefde765666be685766dd9e7aa8cf8f4c0a0de741392be6a711bee9f215042d715af85bcbe4f2f6a

C:\Program Files (x86)\System\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files (x86)\System\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files (x86)\System\webmvorbisdecoder.dll

MD5 ec59d88c3ebda7c2ce36dcdbe4c67e5b
SHA1 8b01a5730ebda5729a57d97abec1de00c7cf0218
SHA256 54b661f2d55f5cafccd7aca334efb89e908b3f19e3e35c9aa661221b31ec60e3
SHA512 46963b390affcb1f6e5d42ae4f4a67a453d9048e8f8b825bb543a1c2031f1ece07d2f295d30eff51a6624bf096e0d10f8ba8d6516b28e63926f214eb7d7e5b84

C:\Program Files (x86)\System\webmmux.dll

MD5 9581f7064028a782182e8a4411e9afa5
SHA1 9356d9f62fc38a1150c3cad556b2a531cd7d430b
SHA256 320a23db8d34bd2628078903d4496d4b9320d50c13d11283f77a8c3b9ec36698
SHA512 01c5a711bd0d7cea5cae906c163b7a98c3b09b8ce5a5b52f096d806e20d7f28fe3e174eb6ba8ff630b870b1cea3d9d72905227a989d70e312d79b55644e6442c

C:\Program Files (x86)\System\webmvorbisencoder.dll

MD5 12eba58e4c0450ccb2d9fdce22255d09
SHA1 1f88ce0834e0bcf0f61ed0557204ef05dd577b1e
SHA256 c80464f71b46411b01962b6095acd6eb2ed09ad8d6eb0a67840826a6297823b2
SHA512 08f999aeb55968de3dacb560a25174e5a1c29eb2ea95a6fc8f770c10369263e2f8cea525f93c89a0e03954ff1221b4486641fc9a892d53a8857e9cf441ec05d4

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

memory/572-97-0x00000000003C0000-0x00000000003C1000-memory.dmp

\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

memory/1768-106-0x0000000000230000-0x0000000000231000-memory.dmp

memory/756-107-0x00000000003C0000-0x00000000003C1000-memory.dmp

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-29 02:45

Reported

2022-01-29 02:52

Platform

win10-en-20211208

Max time kernel

162s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_259388125 C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\RIPCServer.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmmux.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmvorbisdecoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmvorbisencoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\webmvorbisdecoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\svshost.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\Russian.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmmux.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\English.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\English.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\RWLN.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\upgradewin.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\EULA.rtf C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\Russian.lg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\EULA.rtf C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\RIPCServer.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\RWLN.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\webmvorbisencoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\upgradewin.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\svshost.exe C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File created C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A
File opened for modification C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\upgradewin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\svshost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A
N/A N/A C:\Program Files (x86)\System\svshost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3508 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 3508 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 3508 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe C:\Windows\SysWOW64\WScript.exe
PID 2636 wrote to memory of 876 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 876 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 876 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 876 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 4016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 876 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 876 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 876 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 876 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 876 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 876 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 876 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 876 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 2064 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\svshost.exe
PID 876 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 876 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 876 wrote to memory of 420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3584 wrote to memory of 980 N/A C:\Program Files (x86)\System\svshost.exe C:\Program Files (x86)\System\upgradewin.exe
PID 3584 wrote to memory of 980 N/A C:\Program Files (x86)\System\svshost.exe C:\Program Files (x86)\System\upgradewin.exe
PID 3584 wrote to memory of 980 N/A C:\Program Files (x86)\System\svshost.exe C:\Program Files (x86)\System\upgradewin.exe
PID 3584 wrote to memory of 612 N/A C:\Program Files (x86)\System\svshost.exe C:\Program Files (x86)\System\upgradewin.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe

"C:\Users\Admin\AppData\Local\Temp\b9d11c879d885b12b42c64c7c696ecc95c091e76f77c3aad53ecd554f0d2b907.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im svnhost.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systemsmss.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im svshost.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im upgradewin.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im updated.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systemswin.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systems.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im systeminfo.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\System Corporation Update" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Program Files (x86)\System\svshost.exe

svshost.exe /silentinstall

C:\Program Files (x86)\System\svshost.exe

svshost.exe /firewall

C:\Program Files (x86)\System\svshost.exe

svshost.exe /start

C:\Program Files (x86)\System\svshost.exe

"C:\Program Files (x86)\System\svshost.exe"

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h "C:\Program Files (x86)\System" /S /D

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe"

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe" /tray

C:\Program Files (x86)\System\upgradewin.exe

"C:\Program Files (x86)\System\upgradewin.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

C:\Program Files (x86)\System\install.vbs

MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

C:\Program Files (x86)\System\install.bat

MD5 140328806c4c3382b7ef19c64e19ebdc
SHA1 1d2871a5b4b8ee91a25c5ca588017b4bc8700fdf
SHA256 c6ae7f68183dd7d7a864f74005f63e6dffc2c7a21caba6aafd3dff574b1e6d46
SHA512 d64d8b8c89f21cbcc1dbb2e3f652d7d8925c63f952256ac201b0558d05b205db325e74e13d79a5bb675c972adf7944795efd28e9b7cc5b75ddb0081a016a1fc8

C:\Program Files (x86)\System\regedit.reg

MD5 fe6dd859d52909db41dd9a550b659b95
SHA1 72bda6b444e61dfff1aab067664b997720155ad0
SHA256 b0a478398227b17133dc674eb4562476f1400b7dfa56cffa8b960c98321be650
SHA512 ee553ae1dd6ad7351c87b603dce1830b53d517c637222ea7c46f8379a31810cd458420a719695f8484eb98fdb9bcdb856d4670d325d78791ddd5e1d5eeb1b1db

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

memory/2964-209-0x0000000000B60000-0x0000000000CAA000-memory.dmp

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

memory/3548-211-0x0000000000B40000-0x0000000000B41000-memory.dmp

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

C:\Program Files (x86)\System\svshost.exe

MD5 8d071134c46b96619483975fc06a4c2a
SHA1 b6e20f7de308a6e6a9852965e25b581f34e8227b
SHA256 b7c95085ba862cb754172780279fd14e2cb49e805d8a06d28116e26330148ed0
SHA512 5ead70b3abeb8aceffd94335d348b2cc02e122cd87f69e31ea3887c4217ecbf93963338fa7f374d8ca1034b43318b001d7feb4ff75575fe436e15908c0ec4b03

memory/2064-214-0x0000000000C10000-0x0000000000C11000-memory.dmp

memory/3584-215-0x00000000001D0000-0x00000000001F3000-memory.dmp

C:\Program Files (x86)\System\English.lg

MD5 bc25377ade68750b834c81fa71c233b8
SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

C:\Program Files (x86)\System\Russian.lg

MD5 e44e34bc285b709f08f967325d9c8be1
SHA1 e73f05c6a980ec9d006930c5343955f89579b409
SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

C:\Program Files (x86)\System\RIPCServer.dll

MD5 500b5d9c3c0ff50c9bafdccb8ee049bc
SHA1 fce3d53df1dff631e69af83420b4bf8b1c632972
SHA256 c0a5b0f80e85c2e2078feca245bfc78518988b059ea711f65b5060d4f3471838
SHA512 a624bfd524d44365a583a1ea860fcbde4188a3731e026ba23a3118857461bf8298e90ef51a23f438f9241cc5a2c5c472f47c75c8e312eb68664680c9feefbfb9

C:\Program Files (x86)\System\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files (x86)\System\RWLN.dll

MD5 eba6316a7d073079954d638b335d9165
SHA1 4b75e9ae790f51077850b1da60136a182fc06425
SHA256 00e0bffd66abca71e488aa52d2672fd90d17eb25a162e3f7af46856faed2e742
SHA512 65159606e8f771edf6fb56efa6c660a173456662e8d0e92bbefde765666be685766dd9e7aa8cf8f4c0a0de741392be6a711bee9f215042d715af85bcbe4f2f6a

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

C:\Program Files (x86)\System\webmvorbisencoder.dll

MD5 12eba58e4c0450ccb2d9fdce22255d09
SHA1 1f88ce0834e0bcf0f61ed0557204ef05dd577b1e
SHA256 c80464f71b46411b01962b6095acd6eb2ed09ad8d6eb0a67840826a6297823b2
SHA512 08f999aeb55968de3dacb560a25174e5a1c29eb2ea95a6fc8f770c10369263e2f8cea525f93c89a0e03954ff1221b4486641fc9a892d53a8857e9cf441ec05d4

C:\Program Files (x86)\System\webmvorbisdecoder.dll

MD5 ec59d88c3ebda7c2ce36dcdbe4c67e5b
SHA1 8b01a5730ebda5729a57d97abec1de00c7cf0218
SHA256 54b661f2d55f5cafccd7aca334efb89e908b3f19e3e35c9aa661221b31ec60e3
SHA512 46963b390affcb1f6e5d42ae4f4a67a453d9048e8f8b825bb543a1c2031f1ece07d2f295d30eff51a6624bf096e0d10f8ba8d6516b28e63926f214eb7d7e5b84

C:\Program Files (x86)\System\webmmux.dll

MD5 9581f7064028a782182e8a4411e9afa5
SHA1 9356d9f62fc38a1150c3cad556b2a531cd7d430b
SHA256 320a23db8d34bd2628078903d4496d4b9320d50c13d11283f77a8c3b9ec36698
SHA512 01c5a711bd0d7cea5cae906c163b7a98c3b09b8ce5a5b52f096d806e20d7f28fe3e174eb6ba8ff630b870b1cea3d9d72905227a989d70e312d79b55644e6442c

C:\Program Files (x86)\System\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a

memory/980-228-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/612-229-0x0000000000B20000-0x0000000000B21000-memory.dmp

C:\Program Files (x86)\System\upgradewin.exe

MD5 d8aa01236323dab4facb72d3af631203
SHA1 01f18748f9c95121e22df54b192b383baff6b802
SHA256 29ee12279007926e198af8d85a4dd15478db05d4ac2465f02af7c4315d7320df
SHA512 e2b38f3f978afcc7d547d4c3f8f9b882ae6f12df1747fd7bd91a45ea5226fbbdd3fa20835a4765f7d471c50d473cae3f37e7f0c97dbc6fb7c0450f604502da8a