rms | 28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b

Analysis

max time kernel
167s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe
Size

4.0MB
MD5

8143f88bc5d2eb0a03fc56e1f2a39919
SHA1

e8d13cad3117c979f656b81dd70dade47f81a2df
SHA256

28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b
SHA512

7952fd0161fcc9fdc20cba67a9af0bf6c0fc4f5a515394526b51a2412cdd493e15e644e9acfb7cc5865a4fcf8a2b2e2d8c4a8599e4eb2e3e4db6cbcbc2b8e2dd
SSDEEP

98304:jHrKUtFKlxG8DvM+5Di3LJqcYG1vEJ+++tS2TDhZLR/J78TUc:yUtFKlxGwv9pi3E5TJN+jTDhHJQTUc

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e43-156.dat	acprotect
behavioral2/files/0x0006000000022e42-155.dat	acprotect

Executes dropped EXE 9 IoCs

pid	Process
4944	screen%E2%80%AEgnp (1).scr
2112	Image.scr
3460	rutserv.exe
5100	rutserv.exe
1952	rutserv.exe
2964	rutserv.exe
772	rfusclient.exe
2532	rfusclient.exe
5088	rfusclient.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3696	attrib.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e4a-152.dat	upx
behavioral2/files/0x0006000000022e48-153.dat	upx
behavioral2/files/0x0006000000022e43-156.dat	upx
behavioral2/files/0x0006000000022e42-155.dat	upx
behavioral2/files/0x0006000000022e4a-166.dat	upx
behavioral2/memory/3460-168-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e4a-171.dat	upx
behavioral2/memory/5100-173-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/5100-175-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e4a-179.dat	upx
behavioral2/files/0x0006000000022e4a-181.dat	upx
behavioral2/memory/1952-183-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/2964-185-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-190.dat	upx
behavioral2/memory/772-192-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/1952-194-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-189.dat	upx
behavioral2/memory/2532-198-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-200.dat	upx
behavioral2/memory/5088-202-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/5088-204-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/2964-205-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/772-206-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/2532-207-0x0000000000400000-0x0000000000971000-memory.dmp	upx

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Image.scr
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	screen%E2%80%AEgnp (1).scr

Loads dropped DLL 7 IoCs

pid	Process
3460	rutserv.exe
5100	rutserv.exe
1952	rutserv.exe
2964	rutserv.exe
772	rfusclient.exe
2532	rfusclient.exe
5088	rfusclient.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe
File created	C:\Windows\control.ini	cmd.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\russian.lg	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1176	timeout.exe
5044	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4276	taskkill.exe
3736	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	screen%E2%80%AEgnp (1).scr
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	Image.scr

Runs .reg file with regedit 1 IoCs

pid	Process
2796	regedit.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3460	rutserv.exe
3460	rutserv.exe
3460	rutserv.exe
3460	rutserv.exe
3460	rutserv.exe
3460	rutserv.exe
5100	rutserv.exe
5100	rutserv.exe
1952	rutserv.exe
1952	rutserv.exe
2964	rutserv.exe
2964	rutserv.exe
2964	rutserv.exe
2964	rutserv.exe
2964	rutserv.exe
2964	rutserv.exe
772	rfusclient.exe
772	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5088	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	3460	rutserv.exe
Token: SeDebugPrivilege	1952	rutserv.exe
Token: SeTakeOwnershipPrivilege	2964	rutserv.exe
Token: SeTcbPrivilege	2964	rutserv.exe
Token: SeTcbPrivilege	2964	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 2964 wrote to memory of 772	2964	rutserv.exe	106

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3696	attrib.exe
4564	attrib.exe
3340	attrib.exe

C:\Users\Admin\AppData\Local\Temp\28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe
"C:\Users\Admin\AppData\Local\Temp\28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Roaming\screen%E2%80%AEgnp (1).scr
  "C:\Users\Admin\AppData\Roaming\screen%E2%80%AEgnp (1).scr" /S
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exit.js" /S
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Install.cmd" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Image.scr
        
        Image.scr
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exes\io.vbs"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exes\setup.bat" "
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        8⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "regedit.reg"
        8⤵
        Runs .reg file with regedit
        
        PID:2796
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /v FUSClientPath /t REG_SZ /d "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe" /f
        8⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\*.*"
        8⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:3696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll"
        8⤵
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:4564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll"
        8⤵
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:3340
        
        C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
        
        "rutserv.exe" /silentinstall
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
        
        C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
        
        "rutserv.exe" /firewall
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5100
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v DisplayName /t REG_SZ /d "Microsft update for Windows" /f
        8⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v Description /t REG_SZ /d "Microsoft Update" /f
        8⤵
        
        PID:800
        
        C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
        
        "rutserv.exe" /start
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:5044
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 10
        5⤵
        Delays execution with timeout.exe
        
        PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
    3⤵
    PID:1320

C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- - C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
    C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: SetClipboardViewer
    PID:5088
- C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe
  C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
210B

MD5
966fc83399589249fb88249e4a388dc8

SHA1
a3be7afbbb5212535649c2a802ef329211222b30

SHA256
d92140dc0ff8b6e29e357323c4a14d7b61189b4de4eae7239d5efe101b404c40

SHA512
8663d8a46a0a87c02b0dcfbd96426249757c1602fe4786ca60ed5b0aabdb10f9b525f6f24f6257f4df437fd3b8f7655e4d485b709109fb7d858b61d09c2f7e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Image.scr

Filesize
3.7MB

MD5
e0516cf0dec35b080753ad3f4345d255

SHA1
27369f451a1ee7675f5d4bb883648c50dd037775

SHA256
3aa3d862ba31b88825248280916eeb9b02ec4b246b15f3b763b05ec641f4bb3d

SHA512
0c26bb885e622949887f0208d79c3498ea97593bee5c42a211abb24754824e2d3050afd4262d8ad25664454ad80926bddb3a3d44e47fea3da5a86b3541c28d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Image.scr

Filesize
3.7MB

MD5
e0516cf0dec35b080753ad3f4345d255

SHA1
27369f451a1ee7675f5d4bb883648c50dd037775

SHA256
3aa3d862ba31b88825248280916eeb9b02ec4b246b15f3b763b05ec641f4bb3d

SHA512
0c26bb885e622949887f0208d79c3498ea97593bee5c42a211abb24754824e2d3050afd4262d8ad25664454ad80926bddb3a3d44e47fea3da5a86b3541c28d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.cmd

Filesize
102B

MD5
087528ee7425c36648a2b8abc7ff9e53

SHA1
1d64ad06be4200e38d47c642c3d05aa8004b7677

SHA256
0c6fd540ffb7e44bb522f96caf126d7a166bb9cef01167793cb99da004f2cc8b

SHA512
a71eebc7cb4ef310579cad993a29f4c5c8ff4c0b75d0f22aa7d58c43e54a9480e55bfb889a3b2d23e23900ff528d252585098cceae473353f0c5f77d15340f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\de.exe

Filesize
98KB

MD5
3234ca7ffaab06077240020bb183659f

SHA1
9614bb744a82156f461e4b685c0fe570b4776599

SHA256
507af2772c7740f66fd15211f260f7f1989e433b31367587812fce3f67679c51

SHA512
0878b6ef55b11ba632a544e01af4836b00d0b0e4eca7033549d9ac2ad2132a7cab275a4027f8f994fc5e0b99918a657faf2d7914c85d8530742f62d7b3ee06c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\io.vbs

Filesize
115B

MD5
1314d834dc9a58668956252e40c8af4d

SHA1
5d5062e6b06aad2c1f1e51e18e0e293dba1e1a66

SHA256
fad0bbb55f7591b441b351fb693b128f2e384685bf576201d942c10e0047df4f

SHA512
73e636d95414bec0c987ffbe431d16e95c8d95c72d9504880b4e9cdd1a1064bc6afc43974e281bd2c852fa0cc883d131ca5cb27ee3d4966b4c5b09343c52dcc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\regedit.reg

Filesize
24KB

MD5
1dff0413138d8cc66002e0aa67915ea0

SHA1
95ca56c0a7c6c2b8bb9bfade9aefcc4458f0162f

SHA256
b5b91eec5b0f770b076fc71d863bb705a9513432b86e50c2e4175620d718b10b

SHA512
b4632768146fccdbb181dd862ec20c16640ce3dd0ff82fc1f3fdce085f1bb7228cbd85ef6b9bba024f8da9bafa661ace3b448ccba6a6d28879f004c4e22e7b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\rfusclient.exe

Filesize
1.5MB

MD5
cd3b5ff64bf6b307846846ae339ecbce

SHA1
a1fdfbcf870530916260dbaf1c26a2b8e6e7bf87

SHA256
567d261abcf8192d24eb7acffec9776843e3dcf79da4dc498e6d2ccfb1c66756

SHA512
2b89ea05481f2e9d4158eca90b88229bdd91ad172afbaa7412daa9bac08547b213e9b8115a6f2b53becab3c1b97178abf4590cc3dd5edf030b929652f9378860

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\russian.lg

Filesize
48KB

MD5
9558b5bc81eb3d87ca356676cd22a09a

SHA1
1851e3eed3aff625cf9336694d6374ce24ad5814

SHA256
ef247557be6f34aa3ec855e0d0a0367ae0660ff3104791e345363904428de7e8

SHA512
4f034167680f90cb166ad73a52fca40e863f63fe056917bb0603132bbeccc592ddb4a9c7f7a10dd022ec5b326bd24f68b9ebbcbc02879b6419fcdfb6903be434

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\rutserv.exe

Filesize
1.7MB

MD5
68b39d5f5336ece4f423f55b7930abb1

SHA1
1589cd59b2f2faff12b68cecc5eb3147f2002801

SHA256
963b80e909e6f498081cfd1659b752a7f81efae3717336af054b6f22b68b4bd1

SHA512
64173de62a2720745883108ad5132e817096ecb1272bce0b361d50ddc995c80d5bc73d726cf9c35cf1a784066f2b8cd67541e7e610ef71fce061d188c3872021

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\setup.bat

Filesize
14KB

MD5
d53491467530fcbbbdb1a21e9a2ce9d9

SHA1
cd4d1c1c8db6c4dd94fb0a1f63e33d431914e70f

SHA256
6b763244b41836c602ad9afd7c9f08861ac4c1a40532f1e3d8bd10f917c00679

SHA512
5e458d09c655ab20aad84e0c658f3276d8cc7430b2c82dc6b7588a528e534df0f065657633a343e3309063eddbec0724c3077e755ff028879ec5432d58b08332

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\vp8decoder.dll

Filesize
151KB

MD5
565f817a855a681f0b386c9fe970f764

SHA1
da0645c4dd38bfc6415c4e083b505715b8b2bc75

SHA256
7be9bbf87492a63833f6f2665e461d4e097e3326dec3e7984ecca8a916939843

SHA512
0e851284a2c2ea1db7adeaf108cee42472018ff85e8ff28954643f417ff8b61d6d30944112678d47f65b952dbc69c097d3faf54e60b84a51eb92f07efde84f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\vp8encoder.dll

Filesize
257KB

MD5
fd0c05de8c367b6f843c96f014f0d9d7

SHA1
68e6b3d8c3b906b74618c6f17c52b5ad19ab857b

SHA256
a1507cb1240e89bf4f3468f462a5befab762edac1540b0d5f4839c46b137859b

SHA512
12ace11d440f5fad425781f29bd94a12025718764670f0b56d49f8337cd09f43fa0a5d9579d65dcacd47f0dea3a3053b52af795c83972ae1bcc24e5a1cdce13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\exes\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Users\Admin\AppData\Local\Temp\exit.js

Filesize
215B

MD5
c5b2135d95fb4c0be44c84259a735af9

SHA1
fac49486c5c63266a416d0ea68c0a8833204e34e

SHA256
448baef1888397d84eafeb2e380aa654b1c819b912722b866f1b78ab8e3e4b63

SHA512
2c9683c6927f0b26aecada7674e7cd557eb8faf6dc2a75b9b807ad0fbe6994518b55ef1489c8d39fc7fac62bd51ba5918b84f28aa93143d7f2366dd3861cfea3

Download Submit
C:\Users\Admin\AppData\Roaming\screen%E2%80%AEgnp (1).scr

Filesize
3.9MB

MD5
e30ea2560b2d0e9c8bf0b69761b7b733

SHA1
71ae0949041456bdab4f0a3efccd7e0a7e22d69b

SHA256
70eca18fc37a911e4f2a0c773844c9ee70caef08e782b63ef7fe59d529013607

SHA512
e36afd922496c6e9799af9dd730ffb0195036465223f2b667ccb6da5941feef6502f8464847455c2cf88ef54f7594cc2742e111d48287c49aabc8ac048a51b1f

Download Submit
C:\Users\Admin\AppData\Roaming\screen%E2%80%AEgnp (1).scr

Filesize
3.9MB

MD5
e30ea2560b2d0e9c8bf0b69761b7b733

SHA1
71ae0949041456bdab4f0a3efccd7e0a7e22d69b

SHA256
70eca18fc37a911e4f2a0c773844c9ee70caef08e782b63ef7fe59d529013607

SHA512
e36afd922496c6e9799af9dd730ffb0195036465223f2b667ccb6da5941feef6502f8464847455c2cf88ef54f7594cc2742e111d48287c49aabc8ac048a51b1f

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe

Filesize
1.5MB

MD5
cd3b5ff64bf6b307846846ae339ecbce

SHA1
a1fdfbcf870530916260dbaf1c26a2b8e6e7bf87

SHA256
567d261abcf8192d24eb7acffec9776843e3dcf79da4dc498e6d2ccfb1c66756

SHA512
2b89ea05481f2e9d4158eca90b88229bdd91ad172afbaa7412daa9bac08547b213e9b8115a6f2b53becab3c1b97178abf4590cc3dd5edf030b929652f9378860

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe

Filesize
1.5MB

MD5
cd3b5ff64bf6b307846846ae339ecbce

SHA1
a1fdfbcf870530916260dbaf1c26a2b8e6e7bf87

SHA256
567d261abcf8192d24eb7acffec9776843e3dcf79da4dc498e6d2ccfb1c66756

SHA512
2b89ea05481f2e9d4158eca90b88229bdd91ad172afbaa7412daa9bac08547b213e9b8115a6f2b53becab3c1b97178abf4590cc3dd5edf030b929652f9378860

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe

Filesize
1.5MB

MD5
cd3b5ff64bf6b307846846ae339ecbce

SHA1
a1fdfbcf870530916260dbaf1c26a2b8e6e7bf87

SHA256
567d261abcf8192d24eb7acffec9776843e3dcf79da4dc498e6d2ccfb1c66756

SHA512
2b89ea05481f2e9d4158eca90b88229bdd91ad172afbaa7412daa9bac08547b213e9b8115a6f2b53becab3c1b97178abf4590cc3dd5edf030b929652f9378860

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe

Filesize
1.7MB

MD5
68b39d5f5336ece4f423f55b7930abb1

SHA1
1589cd59b2f2faff12b68cecc5eb3147f2002801

SHA256
963b80e909e6f498081cfd1659b752a7f81efae3717336af054b6f22b68b4bd1

SHA512
64173de62a2720745883108ad5132e817096ecb1272bce0b361d50ddc995c80d5bc73d726cf9c35cf1a784066f2b8cd67541e7e610ef71fce061d188c3872021

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe

Filesize
1.7MB

MD5
68b39d5f5336ece4f423f55b7930abb1

SHA1
1589cd59b2f2faff12b68cecc5eb3147f2002801

SHA256
963b80e909e6f498081cfd1659b752a7f81efae3717336af054b6f22b68b4bd1

SHA512
64173de62a2720745883108ad5132e817096ecb1272bce0b361d50ddc995c80d5bc73d726cf9c35cf1a784066f2b8cd67541e7e610ef71fce061d188c3872021

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe

Filesize
1.7MB

MD5
68b39d5f5336ece4f423f55b7930abb1

SHA1
1589cd59b2f2faff12b68cecc5eb3147f2002801

SHA256
963b80e909e6f498081cfd1659b752a7f81efae3717336af054b6f22b68b4bd1

SHA512
64173de62a2720745883108ad5132e817096ecb1272bce0b361d50ddc995c80d5bc73d726cf9c35cf1a784066f2b8cd67541e7e610ef71fce061d188c3872021

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe

Filesize
1.7MB

MD5
68b39d5f5336ece4f423f55b7930abb1

SHA1
1589cd59b2f2faff12b68cecc5eb3147f2002801

SHA256
963b80e909e6f498081cfd1659b752a7f81efae3717336af054b6f22b68b4bd1

SHA512
64173de62a2720745883108ad5132e817096ecb1272bce0b361d50ddc995c80d5bc73d726cf9c35cf1a784066f2b8cd67541e7e610ef71fce061d188c3872021

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
C:\Windows\en-US\DRVSTORE\Dism\ru-RU\Security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll

Filesize
21KB

MD5
0c6cdadc16dc2683c3b158496d8d518f

SHA1
70d0349d59dad508ad0648bc4556a2ea0e1da866

SHA256
717b4deebca593651dd83b44c3436cdd88c56d4cb3901276cfa6c84e595af5ab

SHA512
c44642d973483cf8b6e854d9e437a433d7ae29e89f800d589005d23d047edef461edc680ac48875dbe24f07f78b9080bf3a41fec363016b477899c2facecb487

Download Submit
memory/772-192-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/772-206-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/772-195-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/1952-183-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/1952-194-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/1952-184-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/2532-196-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/2532-198-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/2532-207-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/2964-205-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/2964-185-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/2964-186-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/3460-168-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/3460-169-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/5088-202-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/5088-203-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/5088-204-0x0000000000400000-0x0000000000971000-memory.dmp

Filesize
5.4MB

Download
memory/5100-174-0x0000000073420000-0x0000000073427000-memory.dmp

Filesize
28KB

Download
memory/5100-173-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download
memory/5100-175-0x0000000000400000-0x0000000000A80000-memory.dmp

Filesize
6.5MB

Download