Malware Analysis Report

2024-11-13 16:21

Sample ID 220515-1f8yxaaehq
Target 92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54
SHA256 92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54
Tags
rms aspackv2 rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54

Threat Level: Known bad

The file 92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54 was found to be: Known bad.

Malicious Activity Summary

rms aspackv2 rat trojan upx

RMS

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Executes dropped EXE

ASPack v2.12-2.42

Loads dropped DLL

Checks computer location settings

Drops file in Program Files directory

Enumerates physical storage devices

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Kills process with taskkill

Runs .reg file with regedit

Suspicious behavior: SetClipboardViewer

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-15 21:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-15 21:36

Reported

2022-05-15 21:39

Platform

win7-20220414-en

Max time kernel

140s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe"

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_7079372 C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\rutserv.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\rutserv.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 1932 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 1932 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 1932 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1524 wrote to memory of 2032 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2032 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2032 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2032 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2032 wrote to memory of 980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2032 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2032 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2032 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2032 wrote to memory of 1424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2032 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1908 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1908 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1908 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 1908 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 2032 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 1152 wrote to memory of 1884 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1884 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1884 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1884 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1648 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1648 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1648 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1152 wrote to memory of 1648 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1884 wrote to memory of 1616 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1884 wrote to memory of 1616 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1884 wrote to memory of 1616 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe
PID 1884 wrote to memory of 1616 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe

Processes

C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe

"C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files (x86)\System\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /firewall

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /start

C:\Program Files (x86)\System\rutserv.exe

"C:\Program Files (x86)\System\rutserv.exe"

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe"

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe" /tray

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1932-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

memory/1524-55-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\install.vbs

MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

C:\Program Files (x86)\System\install.bat

MD5 99db27d776e103cad354b531ee1f20b9
SHA1 0b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256 240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512 bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69

memory/2032-59-0x0000000000000000-mapping.dmp

memory/1972-60-0x0000000000000000-mapping.dmp

memory/436-61-0x0000000000000000-mapping.dmp

memory/1488-62-0x0000000000000000-mapping.dmp

memory/980-63-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\regedit.reg

MD5 c6a7d6611c040a2f0653d101d6534866
SHA1 e5e7bd96d666644987598d1cedbc248dbaed3943
SHA256 813ecd5da61fb36561701ff7ac4363c7a9f73c915fa498c0b38aef7c94f3f5b6
SHA512 6561cb215c71a0552496a3f838ad460d4659c0c2c46f495fd27f6af2c12222bb86efa552e27d8cc71f017a1399810660ce00c251c4cd3f625461af12fda6e04e

memory/1424-66-0x0000000000000000-mapping.dmp

\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1688-69-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1688-72-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1688-73-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1688-74-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1688-75-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1688-76-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1908-78-0x0000000000000000-mapping.dmp

memory/1688-77-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-81-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-82-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-83-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-84-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-85-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1908-86-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/580-87-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/580-90-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/580-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/580-92-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/580-93-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/580-94-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1152-97-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1152-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1152-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1152-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1152-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files (x86)\System\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files (x86)\System\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1884-107-0x0000000000000000-mapping.dmp

memory/1648-108-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/580-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1648-114-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1884-115-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1648-116-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1648-118-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1648-120-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1884-119-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1884-121-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1648-122-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1884-123-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1884-117-0x0000000000400000-0x00000000009B6000-memory.dmp

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1616-124-0x0000000000000000-mapping.dmp

memory/1616-127-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1616-128-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1616-129-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1616-130-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1616-131-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1616-132-0x0000000000400000-0x00000000009B6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-15 21:36

Reported

2022-05-15 21:39

Platform

win10v2004-20220414-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe"

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\rutserv.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\install.bat C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\install.vbs C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\regedit.reg C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_240572218 C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File opened for modification C:\Program Files (x86)\System\rutserv.exe C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A
File created C:\Program Files (x86)\System\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\System\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\System\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4892 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 4892 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 4892 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe C:\Windows\SysWOW64\WScript.exe
PID 4316 wrote to memory of 3612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4316 wrote to memory of 3612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4316 wrote to memory of 3612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3612 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3612 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3612 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3612 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3612 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3612 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3612 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3612 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3188 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3188 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 3612 wrote to memory of 3188 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\System\rutserv.exe
PID 4576 wrote to memory of 2496 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 4576 wrote to memory of 2496 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 4576 wrote to memory of 2496 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 4576 wrote to memory of 1772 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 4576 wrote to memory of 1772 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 4576 wrote to memory of 1772 N/A C:\Program Files (x86)\System\rutserv.exe C:\Program Files (x86)\System\rfusclient.exe
PID 2496 wrote to memory of 3552 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe
PID 2496 wrote to memory of 3552 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe
PID 2496 wrote to memory of 3552 N/A C:\Program Files (x86)\System\rfusclient.exe C:\Program Files (x86)\System\rfusclient.exe

Processes

C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe

"C:\Users\Admin\AppData\Local\Temp\92dff0c85afdfc3310dd2d3dc06bff607adc95d53c177467ecacd828d001df54.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /firewall

C:\Program Files (x86)\System\rutserv.exe

rutserv.exe /start

C:\Program Files (x86)\System\rutserv.exe

"C:\Program Files (x86)\System\rutserv.exe"

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe" /tray

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe"

C:\Program Files (x86)\System\rfusclient.exe

"C:\Program Files (x86)\System\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
US 20.189.173.10:443 tcp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
DE 67.24.27.254:80 tcp
BE 8.238.110.126:80 tcp
BE 8.238.110.126:80 tcp
BE 8.238.110.126:80 tcp

Files

memory/4316-130-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\install.vbs

MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

C:\Program Files (x86)\System\install.bat

MD5 99db27d776e103cad354b531ee1f20b9
SHA1 0b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256 240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512 bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69

memory/3612-133-0x0000000000000000-mapping.dmp

memory/4936-134-0x0000000000000000-mapping.dmp

memory/1764-135-0x0000000000000000-mapping.dmp

memory/2336-136-0x0000000000000000-mapping.dmp

memory/1560-137-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\regedit.reg

MD5 c6a7d6611c040a2f0653d101d6534866
SHA1 e5e7bd96d666644987598d1cedbc248dbaed3943
SHA256 813ecd5da61fb36561701ff7ac4363c7a9f73c915fa498c0b38aef7c94f3f5b6
SHA512 6561cb215c71a0552496a3f838ad460d4659c0c2c46f495fd27f6af2c12222bb86efa552e27d8cc71f017a1399810660ce00c251c4cd3f625461af12fda6e04e

memory/4692-139-0x0000000000000000-mapping.dmp

memory/1568-140-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1568-143-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1568-144-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1568-145-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1568-146-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1568-147-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1568-148-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-149-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3352-151-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-152-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-153-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-155-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-154-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3352-156-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3188-157-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3188-159-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3188-160-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3188-161-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3188-162-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3188-163-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files (x86)\System\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/4576-165-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/4576-166-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/4576-167-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/4576-168-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/4576-169-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files (x86)\System\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

C:\Program Files (x86)\System\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

memory/2496-173-0x0000000000000000-mapping.dmp

memory/1772-174-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/3188-178-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2496-177-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2496-180-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1772-179-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1772-182-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1772-183-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1772-185-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2496-187-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2496-184-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1772-186-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2496-181-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-188-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\System\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/3552-190-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-191-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-192-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-193-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-194-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3552-195-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/4576-196-0x0000000000400000-0x0000000000AB9000-memory.dmp