rms | 2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe
Size 5.4MB
Sample220520-pty53seffm
SHA256 2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96
MD5 5a5ba329cdf91fd46e3d0f8129cd0c5b
SHA1 8343efb217dab5253e5018aba48b46c2355455ec
SHA512 52247b7ef75abcd1b903eb8b88cc023d2025850b3219a9452c727e9dcbe7960c8ef299d207cadb76378bc0054720c4af5cdc6866bf022abd5ff40b138d35bfdd
MD5 SHA1 SHA512

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/files/0x0006000000022ecb-135.dat	MailPassView
behavioral2/files/0x0006000000022ecb-134.dat	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x0006000000022ecb-135.dat	WebBrowserPassView
behavioral2/files/0x0006000000022ecb-134.dat	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022ecb-135.dat	Nirsoft
behavioral2/files/0x0006000000022ecb-134.dat	Nirsoft

Executes dropped EXE 10 IoCs

pid	Process
4232	hide.exe
2996	augg.exe
1968	nvidiaInspector.exe
1628	821-409-356.exe
1168	rutserv.exe
3952	rutserv.exe
4412	rutserv.exe
2480	rfusclient.exe
1136	rfusclient.exe
3636	rfusclient.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	821-409-356.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	nvidiaInspector.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	whatismyipaddress.com
7	whatismyipaddress.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000022e98-131.dat	autoit_exe
behavioral2/files/0x0008000000022e98-132.dat	autoit_exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vipcatalog\vp8decoder.dll	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\rutserv.exe	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\start.vbs	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\vp8decoder.dll	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\vp8encoder.dll	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\rfusclient.exe	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\russian.lg	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\russian.lg	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\install.bat	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\rfusclient.exe	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\rutserv.exe	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\regedit.reg	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\regedit.reg	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog	attrib.exe
File created	C:\Windows\SysWOW64\vipcatalog\__tmp_rar_sfx_access_check_240565671	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\start.vbs	821-409-356.exe
File opened for modification	C:\Windows\SysWOW64\vipcatalog\install.bat	821-409-356.exe
File created	C:\Windows\SysWOW64\vipcatalog\vp8encoder.dll	821-409-356.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3960	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4800	taskkill.exe
4912	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	821-409-356.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\>2K9 B5:AB>2K9 4>:C<5=B (3).txt	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\>2K9 B5:AB>2K9 4>:C<5=B (3).txt	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1904	regedit.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1168	rutserv.exe
1168	rutserv.exe
1168	rutserv.exe
1168	rutserv.exe
1168	rutserv.exe
1168	rutserv.exe
3952	rutserv.exe
3952	rutserv.exe
4412	rutserv.exe
4412	rutserv.exe
4412	rutserv.exe
4412	rutserv.exe
4412	rutserv.exe
4412	rutserv.exe
2480	rfusclient.exe
2480	rfusclient.exe

Suspicious behavior: SetClipboardViewer 4 IoCs

pid	Process
1136	rfusclient.exe
2480	rfusclient.exe
1136	rfusclient.exe
3636	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	augg.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	1168	rutserv.exe
Token: SeDebugPrivilege	1968	nvidiaInspector.exe
Token: SeDebugPrivilege	3952	rutserv.exe
Token: SeTakeOwnershipPrivilege	4412	rutserv.exe
Token: SeTcbPrivilege	4412	rutserv.exe
Token: SeTcbPrivilege	4412	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2996	augg.exe
1168	rutserv.exe
3952	rutserv.exe
4412	rutserv.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4232	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	80
PID 4832 wrote to memory of 4232	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	80
PID 4832 wrote to memory of 4232	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	80
PID 4832 wrote to memory of 2996	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	81
PID 4832 wrote to memory of 2996	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	81
PID 4832 wrote to memory of 2996	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	81
PID 4832 wrote to memory of 1968	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	82
PID 4832 wrote to memory of 1968	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	82
PID 4832 wrote to memory of 1628	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	83
PID 4832 wrote to memory of 1628	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	83
PID 4832 wrote to memory of 1628	4832	2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe	83
PID 1628 wrote to memory of 3192	1628	821-409-356.exe	84
PID 1628 wrote to memory of 3192	1628	821-409-356.exe	84
PID 1628 wrote to memory of 3192	1628	821-409-356.exe	84
PID 3192 wrote to memory of 4504	3192	WScript.exe	86
PID 3192 wrote to memory of 4504	3192	WScript.exe	86
PID 3192 wrote to memory of 4504	3192	WScript.exe	86
PID 4504 wrote to memory of 4800	4504	cmd.exe	89
PID 4504 wrote to memory of 4800	4504	cmd.exe	89
PID 4504 wrote to memory of 4800	4504	cmd.exe	89
PID 4504 wrote to memory of 4912	4504	cmd.exe	90
PID 4504 wrote to memory of 4912	4504	cmd.exe	90
PID 4504 wrote to memory of 4912	4504	cmd.exe	90
PID 4504 wrote to memory of 224	4504	cmd.exe	91
PID 4504 wrote to memory of 224	4504	cmd.exe	91
PID 4504 wrote to memory of 224	4504	cmd.exe	91
PID 4504 wrote to memory of 4292	4504	cmd.exe	92
PID 4504 wrote to memory of 4292	4504	cmd.exe	92
PID 4504 wrote to memory of 4292	4504	cmd.exe	92
PID 4504 wrote to memory of 1168	4504	cmd.exe	93
PID 4504 wrote to memory of 1168	4504	cmd.exe	93
PID 4504 wrote to memory of 1168	4504	cmd.exe	93
PID 4504 wrote to memory of 1904	4504	cmd.exe	94
PID 4504 wrote to memory of 1904	4504	cmd.exe	94
PID 4504 wrote to memory of 1904	4504	cmd.exe	94
PID 4504 wrote to memory of 3952	4504	cmd.exe	95
PID 4504 wrote to memory of 3952	4504	cmd.exe	95
PID 4504 wrote to memory of 3952	4504	cmd.exe	95
PID 4412 wrote to memory of 2480	4412	rutserv.exe	98
PID 4412 wrote to memory of 2480	4412	rutserv.exe	98
PID 4412 wrote to memory of 2480	4412	rutserv.exe	98
PID 4412 wrote to memory of 1136	4412	rutserv.exe	97
PID 4412 wrote to memory of 1136	4412	rutserv.exe	97
PID 4412 wrote to memory of 1136	4412	rutserv.exe	97
PID 4504 wrote to memory of 3960	4504	cmd.exe	99
PID 4504 wrote to memory of 3960	4504	cmd.exe	99
PID 4504 wrote to memory of 3960	4504	cmd.exe	99
PID 2480 wrote to memory of 3636	2480	rfusclient.exe	105
PID 2480 wrote to memory of 3636	2480	rfusclient.exe	105
PID 2480 wrote to memory of 3636	2480	rfusclient.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4292	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe
"C:\Users\Admin\AppData\Local\Temp\2e6075783679f70eaa43fe3eeec3fa6a0aa25a2f4984ea690689ef1dc9342a96.exe"
1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\hide.exe
  "C:\Users\Admin\AppData\Local\Temp\hide.exe"
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\augg.exe
  "C:\Users\Admin\AppData\Local\Temp\augg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\nvidiaInspector.exe
  "C:\Users\Admin\AppData\Local\Temp\nvidiaInspector.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\821-409-356.exe
  "C:\Users\Admin\AppData\Local\Temp\821-409-356.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\System32\vipcatalog\start.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\vipcatalog\install.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        5⤵
        
        PID:224
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\System32\vipcatalog"
        5⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4292
    - - C:\Windows\SysWOW64\vipcatalog\rutserv.exe
        
        "rutserv.exe" /silentinstall
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1168
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regedit.reg
        5⤵
        Runs .reg file with regedit
        
        PID:1904
    - - C:\Windows\SysWOW64\vipcatalog\rutserv.exe
        
        "rutserv.exe" /start
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:3960

C:\Windows\SysWOW64\vipcatalog\rutserv.exe
C:\Windows\SysWOW64\vipcatalog\rutserv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
  C:\Windows\SysWOW64\vipcatalog\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: SetClipboardViewer
  PID:1136
- C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
  C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
    C:\Windows\SysWOW64\vipcatalog\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:3636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

821-409-356.exe

Path C:\Users\Admin\AppData\Local\Temp\821-409-356.exe
Size 4.2MB
SHA256 0fd53b6a87bf3c57ee7d4a880eecd4618275cdb917b845b79f75ae695fcf9d04
MD5 948cc33fcc9bd9618864ade457fee646
SHA1 d627e467717319f306c2bfdf9291ea22663ffad0
SHA512 546d4832f71ff970218e654657d47e8b73ab0bc9ea5e2e9c3cbef2fbfbefde35f348a9f963e71bcda4360adb4f3ff93b42ebfe0b3a02730c122d29b70d415cb7
SSDEEP 98304:Uq5xxxou+n2w/A+BZmbSwzNvYl28zoPLMbV:N53Lo20pvwzNi23jMbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

821-409-356.exe

Path C:\Users\Admin\AppData\Local\Temp\821-409-356.exe
Size 4.2MB
SHA256 0fd53b6a87bf3c57ee7d4a880eecd4618275cdb917b845b79f75ae695fcf9d04
MD5 948cc33fcc9bd9618864ade457fee646
SHA1 d627e467717319f306c2bfdf9291ea22663ffad0
SHA512 546d4832f71ff970218e654657d47e8b73ab0bc9ea5e2e9c3cbef2fbfbefde35f348a9f963e71bcda4360adb4f3ff93b42ebfe0b3a02730c122d29b70d415cb7
SSDEEP 98304:Uq5xxxou+n2w/A+BZmbSwzNvYl28zoPLMbV:N53Lo20pvwzNi23jMbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

augg.exe

Path C:\Users\Admin\AppData\Local\Temp\augg.exe
Size 502KB
SHA256 82ad0eab2dc57e90bbad4919ebc48ee6ac20106747991ca6102d060dc1d0b23e
MD5 dc0b1a82b03a2d24d36d0b249e96d92f
SHA1 12069460b20f26b8091554b3cd3a588c70294c29
SHA512 5c8e3ef196f35ca53e8ec99c04fd86bd399dabe19e322e657e300f271e142cfa26574f1c44a9b726a882b746fee79b2b9b31056b6a58d6d9d9e9b9150853eb1f
SSDEEP 6144:9bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9/He:9QtqB5urTIoYWBQk1E+VF9mOx92
MD5 SHA1 SHA512 SSDEEP

Submit Download

augg.exe

Path C:\Users\Admin\AppData\Local\Temp\augg.exe
Size 502KB
SHA256 82ad0eab2dc57e90bbad4919ebc48ee6ac20106747991ca6102d060dc1d0b23e
MD5 dc0b1a82b03a2d24d36d0b249e96d92f
SHA1 12069460b20f26b8091554b3cd3a588c70294c29
SHA512 5c8e3ef196f35ca53e8ec99c04fd86bd399dabe19e322e657e300f271e142cfa26574f1c44a9b726a882b746fee79b2b9b31056b6a58d6d9d9e9b9150853eb1f
SSDEEP 6144:9bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9/He:9QtqB5urTIoYWBQk1E+VF9mOx92
MD5 SHA1 SHA512 SSDEEP

Submit Download

hide.exe

Path C:\Users\Admin\AppData\Local\Temp\hide.exe
Size 839KB
SHA256 69892a3a4d5083f9a7cb561b4c4df32a9bca7bfbd91c5d720fe60ffcb63dc0fa
MD5 c2d5f3b0ed47c0d4e4127780d4cf656d
SHA1 c1b14c5186772dea8105dd21a8ca212f044f32fd
SHA512 bb66a379a153b46603be8a416ef8f785fbba70421cf3ac7610012e8008d54e7c8685e7432181fb0c3349ba0bf14e59c3923d8aaf5a1f6122ff2c8a00f429be24
SSDEEP 12288:dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaF7Le6A:dtb20pkaCqT5TBWgNQ7aZLe6A
MD5 SHA1 SHA512 SSDEEP

Submit Download

hide.exe

Path C:\Users\Admin\AppData\Local\Temp\hide.exe
Size 839KB
SHA256 69892a3a4d5083f9a7cb561b4c4df32a9bca7bfbd91c5d720fe60ffcb63dc0fa
MD5 c2d5f3b0ed47c0d4e4127780d4cf656d
SHA1 c1b14c5186772dea8105dd21a8ca212f044f32fd
SHA512 bb66a379a153b46603be8a416ef8f785fbba70421cf3ac7610012e8008d54e7c8685e7432181fb0c3349ba0bf14e59c3923d8aaf5a1f6122ff2c8a00f429be24
SSDEEP 12288:dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaF7Le6A:dtb20pkaCqT5TBWgNQ7aZLe6A
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvidiaInspector.exe

Path C:\Users\Admin\AppData\Local\Temp\nvidiaInspector.exe
Size 453KB
SHA256 7f4741ab5e1906cc0d7436d6971863f2a24ab3c64af9fc625b3e7d7621e10bbc
MD5 dedadf41de16464ec2ff6f1181270b17
SHA1 cd1201e094cd7b27f59292fb99d435420ea496aa
SHA512 0c09673315651021b51884977f2e8f5a541ba5e6728b514cdf96d459b5840d27bbb840ff29c3e1aab84e6460f2b908dcfeaa6c2c3ba8409a1fc36015fe83fb13
SSDEEP 6144:SMkiQLP4mIShCo5NxgHGVByJdjdHGn4IWg2dCGads0AySf:Vm43qvx/rmnG4btl
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvidiaInspector.exe

Path C:\Users\Admin\AppData\Local\Temp\nvidiaInspector.exe
Size 453KB
SHA256 7f4741ab5e1906cc0d7436d6971863f2a24ab3c64af9fc625b3e7d7621e10bbc
MD5 dedadf41de16464ec2ff6f1181270b17
SHA1 cd1201e094cd7b27f59292fb99d435420ea496aa
SHA512 0c09673315651021b51884977f2e8f5a541ba5e6728b514cdf96d459b5840d27bbb840ff29c3e1aab84e6460f2b908dcfeaa6c2c3ba8409a1fc36015fe83fb13
SSDEEP 6144:SMkiQLP4mIShCo5NxgHGVByJdjdHGn4IWg2dCGads0AySf:Vm43qvx/rmnG4btl
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.bat

Path C:\Windows\SysWOW64\vipcatalog\install.bat
Size 308B
SHA256 a9e5c0e62e154171b5cd8bfbbda21d3de43d96614533aa45fdc298fe74c10c76
MD5 d7257fb016b4c895bbd0a014811fc380
SHA1 fff0b0f132e2e2cba1fc986f941ded5d494214b2
SHA512 86ba1ffb928400592e158e86789c7b7bf41b41a5c8303ad9aea8f942b2d6497546b881c9327bd196ae852e01e5edc32edc4992040560cd3d8b0486561dad8853
MD5 SHA1 SHA512

Submit Download

regedit.reg

Path C:\Windows\SysWOW64\vipcatalog\regedit.reg
Size 13KB
SHA256 198a4e95869fa067944fa7bba2bafd2477cb366a742dce459b38ddabd09df3eb
MD5 37a1899e1081f8ceb2a91293059389e0
SHA1 421c7785bd0684354b1ceb310611c2d4dbfad0d7
SHA512 64ef426e960a6f75b4d3426daaea0f2434025a7786bd4480a55ee2e96273d8ff2a31c7e16f85abceee64c9a0f115d8952ea56d88057953a0b486599eefe86612
SSDEEP 192:5YpGS7rpyU0zURWbgpfUm/2yUXNSpChvyI7TOt9SmHGdlfYibrUv5ej1URX8pGQ6:5CsVbA/29NkQKpLz6GPt
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
Size 5.1MB
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494
SSDEEP 49152:WjR6DGsvhIPBzEoZ6SNbpJjwsmozStrH45/oYEa0DqniEkopJKfTnTPmcFeIMwm1:WjAL+p5Us55/0DNFoWFq1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
Size 5.1MB
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494
SSDEEP 49152:WjR6DGsvhIPBzEoZ6SNbpJjwsmozStrH45/oYEa0DqniEkopJKfTnTPmcFeIMwm1:WjAL+p5Us55/0DNFoWFq1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
Size 5.1MB
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494
SSDEEP 49152:WjR6DGsvhIPBzEoZ6SNbpJjwsmozStrH45/oYEa0DqniEkopJKfTnTPmcFeIMwm1:WjAL+p5Us55/0DNFoWFq1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\SysWOW64\vipcatalog\rfusclient.exe
Size 5.1MB
SHA256 b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
MD5 e3c15e4d44c2b546d640b5808a9a2818
SHA1 090f6f75558614f19b970df39ebe1a87185f5a0c
SHA512 c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494
SSDEEP 49152:WjR6DGsvhIPBzEoZ6SNbpJjwsmozStrH45/oYEa0DqniEkopJKfTnTPmcFeIMwm1:WjAL+p5Us55/0DNFoWFq1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

russian.lg

Path C:\Windows\SysWOW64\vipcatalog\russian.lg
Size 48KB
SHA256 5c394e7f7e6571ea2de8ebf23d087d452ccfda4b7468db793ce11cafac3e92a1
MD5 37b80cc200e62cdb350f7c86ee61264c
SHA1 35885999a4dc527dfc6d67079c5f82dd4759d78d
SHA512 7c1831fdf6584eab78d63245295014ab9361fbfe30c4304c11b4d8ce3eca784d2528c3a3d5183bc05118ab4054ae90cfcfe6a7b1f666839dc45acf5bc4ac2481
SSDEEP 384:4KS6FpsTkMiUUaTzVnYwu6GX2GejSkdBz+lcvN7sdW:XsTkT2F9dB7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\SysWOW64\vipcatalog\rutserv.exe
Size 6.0MB
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9
SSDEEP 98304:q+bTiFIqw967DCmYZsfEPptw5tohLuiVr:q+iFMAfCKtoDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\SysWOW64\vipcatalog\rutserv.exe
Size 6.0MB
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9
SSDEEP 98304:q+bTiFIqw967DCmYZsfEPptw5tohLuiVr:q+iFMAfCKtoDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\SysWOW64\vipcatalog\rutserv.exe
Size 6.0MB
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9
SSDEEP 98304:q+bTiFIqw967DCmYZsfEPptw5tohLuiVr:q+iFMAfCKtoDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\SysWOW64\vipcatalog\rutserv.exe
Size 6.0MB
SHA256 fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
MD5 8f6e38cc55206473121c8bf63fcbcf2d
SHA1 35504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA512 083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9
SSDEEP 98304:q+bTiFIqw967DCmYZsfEPptw5tohLuiVr:q+iFMAfCKtoDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

start.vbs

Path C:\Windows\SysWOW64\vipcatalog\start.vbs
Size 117B
SHA256 a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
MD5 65fc32766a238ff3e95984e325357dbb
SHA1 3ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA512 621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
MD5 SHA1 SHA512

Submit Download

vp8decoder.dll

Path C:\Windows\SysWOW64\vipcatalog\vp8decoder.dll
Size 378KB
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
SSDEEP 6144:QIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcT:QI8tiDOzyH9H8Tu6h04fZMZoMPuvfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Windows\SysWOW64\vipcatalog\vp8encoder.dll
Size 1.6MB
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
SSDEEP 49152:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1968-155-0x0000000000AEA000-0x0000000000AEF000-memory.dmp

Download

memory/1968-142-0x00007FFBDF590000-0x00007FFBDFFC6000-memory.dmp

Download

memory/2996-143-0x0000000072E30000-0x00000000733E1000-memory.dmp

Download