Malware Analysis Report

2024-11-13 16:21

Sample ID 220511-rtspeacfgl
Target 3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c
SHA256 3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c
Tags
rms evasion rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c

Threat Level: Known bad

The file 3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan

RMS

Executes dropped EXE

Sets file to hidden

Loads dropped DLL

Checks computer location settings

Drops file in Program Files directory

Enumerates physical storage devices

Modifies registry class

Kills process with taskkill

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: SetClipboardViewer

Views/modifies file attributes

Runs .reg file with regedit

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-11 14:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-11 14:29

Reported

2022-05-11 14:56

Platform

win7-20220414-en

Max time kernel

54s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 1880 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 944 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 276 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1076 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 280 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe

"C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\control\start.vbs"

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

"C:\Users\Admin\AppData\Roaming\Windows\control\run.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp

C:\Windows\SysWOW64\attrib.exe

attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

Network

N/A

Files

memory/1880-54-0x00000000758D1000-0x00000000758D3000-memory.dmp

memory/944-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\control\start.vbs

MD5 7c274b85448ea218e5c6d5521876f698
SHA1 bdd771453446e1e8654985f5c4b7ebb0bb9ada4d
SHA256 427b7d229ae6a8717edb0e5cc156c2025d0d737400d6a22d5de9d4504b7b3185
SHA512 3c0a482e3f5b628cccae9730fb7fbf2f9e8c6fb7d8c52d39beffe8b3a3de184d2df6d5fa412801eca6cf80a7ee8109394e4918c467af88dac767462f01051df6

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

memory/2012-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

memory/276-64-0x0000000000000000-mapping.dmp

memory/1724-66-0x0000000000000000-mapping.dmp

memory/1076-68-0x0000000000000000-mapping.dmp

memory/1164-70-0x0000000000000000-mapping.dmp

memory/280-72-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-11 14:29

Reported

2022-05-11 14:56

Platform

win10v2004-20220414-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Windows\control\data.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\RMS\regedit.reg C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\russian.lg C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\regedit.reg C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\RMS\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\RMS\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\regedit.reg C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files\RMS\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\RMS\russian.lg C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\RMS\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\RMS\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\russian.lg C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\RMS\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\Windows\control\data.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\RMS\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\RMS\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\RMS\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\RMS\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\RMS\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\RMS\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\RMS\rutserv.exe N/A
N/A N/A C:\Program Files\RMS\rutserv.exe N/A
N/A N/A C:\Program Files\RMS\rutserv.exe N/A
N/A N/A C:\Program Files\RMS\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4168 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 4168 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 4168 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe C:\Windows\SysWOW64\WScript.exe
PID 4588 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 4588 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 4588 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\Windows\control\run.exe
PID 3092 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 1872 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1872 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1872 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3092 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3264 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows\control\data.exe
PID 3264 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows\control\data.exe
PID 3264 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows\control\data.exe
PID 4060 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Windows\control\data.exe C:\Windows\SysWOW64\WScript.exe
PID 4060 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Windows\control\data.exe C:\Windows\SysWOW64\WScript.exe
PID 4060 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Windows\control\data.exe C:\Windows\SysWOW64\WScript.exe
PID 3500 wrote to memory of 3756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Windows\control\run.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe

"C:\Users\Admin\AppData\Local\Temp\3f7dab7cdfdb383c4d7b5f950e1336eb41e3288c958ba4936419d41a40bbd31c.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\control\start.vbs"

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

"C:\Users\Admin\AppData\Roaming\Windows\control\run.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp

C:\Windows\SysWOW64\attrib.exe

attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp84107.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp84107.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat "C:\Users\Admin\AppData\Roaming\Windows\control\run.exe"

C:\Users\Admin\AppData\Roaming\Windows\control\data.exe

data.exe -p4387548329574239857234 -d C:\Log

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\start.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Log\install.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp84107.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp84107.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\RMS"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\RMS\*.*"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Program Files\RMS\rfusclient.exe"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Program Files\RMS\rutserv.exe"

C:\Windows\SysWOW64\regedit.exe

regedit /s regedit.reg

C:\Program Files\RMS\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\RMS\rutserv.exe

rutserv.exe /firewall

C:\Program Files\RMS\rutserv.exe

rutserv.exe /start

C:\Program Files\RMS\rutserv.exe

"C:\Program Files\RMS\rutserv.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\RMS\rfusclient.exe

"C:\Program Files\RMS\rfusclient.exe"

C:\Program Files\RMS\rfusclient.exe

"C:\Program Files\RMS\rfusclient.exe" /tray

C:\Program Files\RMS\rfusclient.exe

"C:\Program Files\RMS\rfusclient.exe" /tray

Network

Country Destination Domain Proto
NL 20.190.160.134:443 tcp
NL 20.190.160.134:443 tcp
NL 20.190.160.134:443 tcp
FR 2.18.109.224:443 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.73:443 tcp
IE 13.69.239.73:443 tcp
US 104.18.25.243:80 tcp
NL 20.190.160.132:443 tcp
NL 20.190.160.132:443 tcp
NL 20.190.160.132:443 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
NL 20.190.160.69:443 tcp
NL 20.190.160.69:443 tcp
NL 20.190.160.69:443 tcp
US 93.184.220.29:80 tcp
NL 20.190.160.71:443 tcp
NL 20.190.160.71:443 tcp
NL 20.190.160.71:443 tcp
NL 20.190.160.67:443 tcp
NL 20.190.160.67:443 tcp
NL 20.190.160.67:443 tcp

Files

memory/4588-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\control\start.vbs

MD5 7c274b85448ea218e5c6d5521876f698
SHA1 bdd771453446e1e8654985f5c4b7ebb0bb9ada4d
SHA256 427b7d229ae6a8717edb0e5cc156c2025d0d737400d6a22d5de9d4504b7b3185
SHA512 3c0a482e3f5b628cccae9730fb7fbf2f9e8c6fb7d8c52d39beffe8b3a3de184d2df6d5fa412801eca6cf80a7ee8109394e4918c467af88dac767462f01051df6

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

memory/3092-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\control\run.exe

MD5 5f56f53c24ea5f9bda096511228c9e40
SHA1 1103ed5f6571a334dfae63fefeb0d1f3a2a616c2
SHA256 4ae925d4b3bb61c460e8a91174e5d3a0e24df5c7d660ed63bce3272c91359ba4
SHA512 a621859008c1f38f0c9ea53dbbfc82ccdca9bcdf402d2ac868a202f2bb39d4cef5338cf69df30980aa4d5bea0c062f4be26f00f3b56979920863445e980f4ecb

memory/2100-135-0x0000000000000000-mapping.dmp

memory/1696-136-0x0000000000000000-mapping.dmp

memory/1872-137-0x0000000000000000-mapping.dmp

memory/1796-138-0x0000000000000000-mapping.dmp

memory/4832-139-0x0000000000000000-mapping.dmp

memory/3288-140-0x0000000000000000-mapping.dmp

memory/1052-141-0x0000000000000000-mapping.dmp

memory/752-142-0x0000000000000000-mapping.dmp

memory/1624-143-0x0000000000000000-mapping.dmp

memory/4444-144-0x0000000000000000-mapping.dmp

memory/1016-145-0x0000000000000000-mapping.dmp

memory/1372-146-0x0000000000000000-mapping.dmp

memory/3948-147-0x0000000000000000-mapping.dmp

memory/3264-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\ytmp\tmp95297.bat

MD5 caf7610cfd469cdbb59237fdf31d8e02
SHA1 927e261261340f1677a6852d77a2c5cec71be5d6
SHA256 882b10b5718f1d5fa8e496fc16838c9f3e48e14a093122ec20c4ecdc94cd765c
SHA512 2579c7dde9fc90642490ccbf4e81a1293da1c7eddc81125f66b662fb252c2a188c63776712ee063a365f581483a2520b47a41600542bbb3334c54a37eb6a9f26

memory/4060-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windows\control\data.exe

MD5 fe67f3e0cd5756ed00ab17769f2223a5
SHA1 78ac681f434170e022679972c135138b2ebd53ad
SHA256 461d28c0e30a9d517ccec017eb70e127696d7d088b551b4dc6961b1055c35975
SHA512 30fa4d9206698377d969d04eba1c846a5dcad1911a54b371a63084e0b96a96300910723146ca4bf7bae1ce44b911baea6abc5799918bb0aa7f8be7ffab443fbf

C:\Users\Admin\AppData\Roaming\Windows\control\data.exe

MD5 fe67f3e0cd5756ed00ab17769f2223a5
SHA1 78ac681f434170e022679972c135138b2ebd53ad
SHA256 461d28c0e30a9d517ccec017eb70e127696d7d088b551b4dc6961b1055c35975
SHA512 30fa4d9206698377d969d04eba1c846a5dcad1911a54b371a63084e0b96a96300910723146ca4bf7bae1ce44b911baea6abc5799918bb0aa7f8be7ffab443fbf

memory/3500-153-0x0000000000000000-mapping.dmp

C:\Log\start.vbs

MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

C:\Log\install.bat

MD5 f02f205c3aa7e6344e02d9ae24e0c1d8
SHA1 922a9ac42cfe6cf4a8c92b1c8f0966aa06bd16db
SHA256 e7a8b3a79a24e96abdbc31fa6e5888d9a7486f161fd99aa0211d39856bcd8f99
SHA512 8af98e7d161eb0bb90d8eee6f5ec424c029a62ae04fa6787de926044008db09f4a62eea2cf69c889cec219114d45fd15f0a729a27a688c5275b545f4280cfa9a

memory/3756-156-0x0000000000000000-mapping.dmp

memory/2012-157-0x0000000000000000-mapping.dmp

memory/4568-158-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\ytmp\tmp84107.exe

MD5 3c52638971ead82b5929d605c1314ee0
SHA1 7318148a40faca203ac402dff51bbb04e638545c
SHA256 5614459ec05fdf6110fa8ce54c34e859671eeffba2b7bb4b1ad6c2c6706855ab
SHA512 46f85f730e3ca9a57f51416c6ab4d03f868f895568eee8f7943cd249b2f71d2a3e83c34e7132715c983d3efaa865a9cb599a4278c911130a0a6948a535c0573b

memory/2556-160-0x0000000000000000-mapping.dmp

memory/1740-161-0x0000000000000000-mapping.dmp

memory/2140-162-0x0000000000000000-mapping.dmp

memory/4352-163-0x0000000000000000-mapping.dmp

C:\Log\regedit.reg

MD5 3591fbf25f928d5725be8472f49bcf31
SHA1 c0e3fa698fdbbdcd9a5f87d9c2119376ae4b91eb
SHA256 1ee3d52956d8fee25a83003b9cc05d959c823dc13d538a9e6f4e8c78b96d305e
SHA512 52f6c91c1cdd7dea78c4699b04496745f31b37c37938f23b554c19e9c9b9b6a77991a7829bc7612daaa9246aa0e23d382aeb48d2f81f6e90e4242a4796b96b60

memory/1880-165-0x0000000000000000-mapping.dmp

memory/4452-166-0x0000000000000000-mapping.dmp

C:\Log\rfusclient.exe

MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494

C:\Log\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

C:\Log\russian.lg

MD5 37b80cc200e62cdb350f7c86ee61264c
SHA1 35885999a4dc527dfc6d67079c5f82dd4759d78d
SHA256 5c394e7f7e6571ea2de8ebf23d087d452ccfda4b7468db793ce11cafac3e92a1
SHA512 7c1831fdf6584eab78d63245295014ab9361fbfe30c4304c11b4d8ce3eca784d2528c3a3d5183bc05118ab4054ae90cfcfe6a7b1f666839dc45acf5bc4ac2481

C:\Log\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Log\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

memory/2468-172-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\regedit.reg

MD5 3591fbf25f928d5725be8472f49bcf31
SHA1 c0e3fa698fdbbdcd9a5f87d9c2119376ae4b91eb
SHA256 1ee3d52956d8fee25a83003b9cc05d959c823dc13d538a9e6f4e8c78b96d305e
SHA512 52f6c91c1cdd7dea78c4699b04496745f31b37c37938f23b554c19e9c9b9b6a77991a7829bc7612daaa9246aa0e23d382aeb48d2f81f6e90e4242a4796b96b60

C:\Program Files\RMS\rfusclient.exe

MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494

C:\Program Files\RMS\russian.lg

MD5 37b80cc200e62cdb350f7c86ee61264c
SHA1 35885999a4dc527dfc6d67079c5f82dd4759d78d
SHA256 5c394e7f7e6571ea2de8ebf23d087d452ccfda4b7468db793ce11cafac3e92a1
SHA512 7c1831fdf6584eab78d63245295014ab9361fbfe30c4304c11b4d8ce3eca784d2528c3a3d5183bc05118ab4054ae90cfcfe6a7b1f666839dc45acf5bc4ac2481

C:\Program Files\RMS\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\RMS\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\RMS\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

memory/4880-179-0x0000000000000000-mapping.dmp

memory/5032-180-0x0000000000000000-mapping.dmp

memory/3236-181-0x0000000000000000-mapping.dmp

memory/3136-182-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

memory/3104-184-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

memory/2760-186-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

C:\Program Files\RMS\rutserv.exe

MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9

memory/312-189-0x0000000000000000-mapping.dmp

memory/1312-190-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\rfusclient.exe

MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494

C:\Program Files\RMS\rfusclient.exe

MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494

memory/768-192-0x0000000000000000-mapping.dmp

memory/2340-194-0x0000000000000000-mapping.dmp

C:\Program Files\RMS\rfusclient.exe

MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494