rms | 8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e

Analysis

max time kernel
175s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe
Size

3.3MB
MD5

d5d9043d6ddff5cc436e065d447531a5
SHA1

21ccbed51c717ca3e5605dad8df2e73772b51ff9
SHA256

8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e
SHA512

cc7392bc0191857c5dc6921db083330b18ea99523372e5270ee92aef0ef0b061e99dd846572e2a85fa4f227022fa8594db14c68ae992eeaadba41463ebfe3ce9
SSDEEP

49152:QAJYaS9FFNGvLR9Zn8tIGRH3pLsDzTMbp8TbyGPkGzki0l+ROOROhRpFSS21MzvE:7JYZFU9ZfG3YDzTt9cGzki2adRU+tW4

Score

10^/10

rms collection discovery evasion rat spyware stealer trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 6 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exempr.exerealip.exe

pid process

3056 rutserv.exe
228 rutserv.exe
2236 rutserv.exe
3968 rutserv.exe
4484 mpr.exe
2804 realip.exe
Modifies Windows Firewall 1 TTPs 8 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

3040 netsh.exe
4524 netsh.exe
4464 netsh.exe
3448 netsh.exe
3048 netsh.exe
2532 netsh.exe
3568 netsh.exe
4340 netsh.exe

pid	process
3056	rutserv.exe
228	rutserv.exe
2236	rutserv.exe
3968	rutserv.exe
4484	mpr.exe
2804	realip.exe

pid	process
3040	netsh.exe
4524	netsh.exe
4464	netsh.exe
3448	netsh.exe
3048	netsh.exe
2532	netsh.exe
3568	netsh.exe
4340	netsh.exe

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
4408	attrib.exe
3268	attrib.exe
3684	attrib.exe
2876	attrib.exe
3252	attrib.exe
3472	attrib.exe
1272	attrib.exe
4472	attrib.exe
1212	attrib.exe
4736	attrib.exe
628	attrib.exe
1600	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 8 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid process

3056 rutserv.exe
3056 rutserv.exe
228 rutserv.exe
228 rutserv.exe
2236 rutserv.exe
2236 rutserv.exe
3968 rutserv.exe
3968 rutserv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3056	rutserv.exe
3056	rutserv.exe
228	rutserv.exe
228	rutserv.exe
2236	rutserv.exe
2236	rutserv.exe
3968	rutserv.exe
3968	rutserv.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mpr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mpr.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mpr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 34 IoCs

Processes:

rutserv.execmd.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	attrib.exe
File created	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1128 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

3968 taskkill.exe
860 taskkill.exe
1204 taskkill.exe
4176 taskkill.exe
3960 taskkill.exe

pid	process
1128	sc.exe

pid	process
3968	taskkill.exe
860	taskkill.exe
1204	taskkill.exe
4176	taskkill.exe
3960	taskkill.exe

Modifies registry class 22 IoCs

Processes:

mpr.exe8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mpr.exe"	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpr.DocHostUIHandler\Clsid	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	mpr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0"	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell	mpr.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpr.DocHostUIHandler	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "mpr.DocHostUIHandler"	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mpr.DocHostUIHandler\ = "Implements DocHostUIHandler"	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf"	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mpr.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	mpr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8"	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mpr.exe,0"	mpr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mpr.exe \"%1\""	mpr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	mpr.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2068 reg.exe
1180 reg.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

4488 regedit.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rutserv.exempr.exe

pid process

3968 rutserv.exe
3968 rutserv.exe
3968 rutserv.exe
3968 rutserv.exe
4484 mpr.exe
4484 mpr.exe
4484 mpr.exe
4484 mpr.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644

pid	process
2068	reg.exe
1180	reg.exe

pid	process
4488	regedit.exe

pid	process
3968	rutserv.exe
3968	rutserv.exe
3968	rutserv.exe
3968	rutserv.exe
4484	mpr.exe
4484	mpr.exe
4484	mpr.exe
4484	mpr.exe

pid	process
644

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exempr.exe

description	pid	process
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	3056	rutserv.exe
Token: SeDebugPrivilege	2236	rutserv.exe
Token: SeTakeOwnershipPrivilege	3968	rutserv.exe
Token: SeDebugPrivilege	4484	mpr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mpr.exe

pid process

4484 mpr.exe
4484 mpr.exe

pid	process
4484	mpr.exe
4484	mpr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exeWScript.execmd.exenet.exe

description	pid	process	target process
PID 1332 wrote to memory of 2180	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	WScript.exe
PID 1332 wrote to memory of 2180	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	WScript.exe
PID 1332 wrote to memory of 2180	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	WScript.exe
PID 2180 wrote to memory of 3176	2180	WScript.exe	cmd.exe
PID 2180 wrote to memory of 3176	2180	WScript.exe	cmd.exe
PID 2180 wrote to memory of 3176	2180	WScript.exe	cmd.exe
PID 3176 wrote to memory of 3960	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 3960	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 3960	3176	cmd.exe	taskkill.exe
PID 1332 wrote to memory of 4232	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	cmd.exe
PID 1332 wrote to memory of 4232	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	cmd.exe
PID 1332 wrote to memory of 4232	1332	8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe	cmd.exe
PID 3176 wrote to memory of 3968	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 3968	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 3968	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 2812	3176	cmd.exe	reg.exe
PID 3176 wrote to memory of 2812	3176	cmd.exe	reg.exe
PID 3176 wrote to memory of 2812	3176	cmd.exe	reg.exe
PID 3176 wrote to memory of 4408	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4408	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4408	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1272	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1272	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1272	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3268	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3268	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3268	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4472	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1212	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1212	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1212	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4736	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4736	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 4736	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3684	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3684	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3684	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 2876	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 2876	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 2876	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3252	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3252	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 3252	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 628	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 628	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 628	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1600	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1600	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 1600	3176	cmd.exe	attrib.exe
PID 3176 wrote to memory of 2936	3176	cmd.exe	net.exe
PID 3176 wrote to memory of 2936	3176	cmd.exe	net.exe
PID 3176 wrote to memory of 2936	3176	cmd.exe	net.exe
PID 2936 wrote to memory of 2216	2936	net.exe	net1.exe
PID 2936 wrote to memory of 2216	2936	net.exe	net1.exe
PID 2936 wrote to memory of 2216	2936	net.exe	net1.exe
PID 3176 wrote to memory of 860	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 860	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 860	3176	cmd.exe	taskkill.exe
PID 3176 wrote to memory of 1204	3176	cmd.exe	taskkill.exe

Views/modifies file attributes 1 TTPs 18 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
3472	attrib.exe
1212	attrib.exe
3252	attrib.exe
2544	attrib.exe
4408	attrib.exe
4472	attrib.exe
628	attrib.exe
4328	attrib.exe
3340	attrib.exe
1452	attrib.exe
3268	attrib.exe
4736	attrib.exe
2876	attrib.exe
1600	attrib.exe
1272	attrib.exe
2628	attrib.exe
5008	attrib.exe
3684	attrib.exe

outlook_win_path 1 IoCs

Processes:

mpr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpr.exe

C:\Users\Admin\AppData\Local\Temp\8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe
"C:\Users\Admin\AppData\Local\Temp\8046f1d7935e9a1b3b3a426f1ef001b087c7aab8c55834dbb48eb3a0da40007e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im RManServer.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
4⤵
PID:2812

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\System32\catroot3"
4⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:4408

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3472

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1272

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3268

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4472

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1212

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4736

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3684

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2876

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3252

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:628

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Windows\System32\de.exe"
4⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1600

C:\Windows\SysWOW64\net.exe
net stop rserver3
4⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop rserver3
5⤵
PID:2216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rserver3.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im r_server.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cam_server.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\system32\cam_server.exe"
4⤵
- Views/modifies file attributes
PID:2544

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
4⤵
- Views/modifies file attributes
PID:2628

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Windows\system32\rserver30"
4⤵
- Views/modifies file attributes
PID:5008

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Windows\SysWOW64\rserver30"
4⤵
- Views/modifies file attributes
PID:4328

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\system32\r_server.exe"
4⤵
- Views/modifies file attributes
PID:3340

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
4⤵
- Views/modifies file attributes
PID:1452

C:\Windows\SysWOW64\net.exe
net stop Telnet
4⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Telnet
5⤵
PID:4564

C:\Windows\SysWOW64\sc.exe
sc config tlntsvr start= disabled
4⤵
- Launches sc.exe
PID:1128

C:\Windows\SysWOW64\net.exe
net stop "Service Host Controller"
4⤵
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Service Host Controller"
5⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net user HelpAssistant /delete
4⤵
PID:4456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user HelpAssistant /delete
5⤵
PID:4268

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn security /f
4⤵
PID:4064

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="RealIP"
4⤵
- Modifies Windows Firewall
PID:3048

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
4⤵
- Modifies Windows Firewall
PID:2532

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="Service Host Controller"
4⤵
- Modifies Windows Firewall
PID:3568

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
4⤵
- Modifies Windows Firewall
PID:4340

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
4⤵
- Modifies Windows Firewall
PID:3040

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete portopening tcp 57009
4⤵
- Modifies Windows Firewall
PID:4524

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="cam_server"
4⤵
- Modifies Windows Firewall
PID:4464

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete portopening tcp 57011 all
4⤵
- Modifies Windows Firewall
PID:3448

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
4⤵
- Modifies registry key
PID:2068

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
4⤵
- Modifies registry key
PID:1180

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
4⤵
PID:4676

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
4⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
4⤵
PID:2256

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /silentinstall
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /firewall
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:228

C:\Windows\SysWOW64\regedit.exe
regedit /s set.reg
4⤵
- Runs .reg file with regedit
PID:4488

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /start
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Users\Admin\AppData\Local\Temp\mpr.exe
C:\Users\Admin\AppData\Local\Temp\mpr.exe /export
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:4484

C:\Users\Admin\AppData\Local\Temp\realip.exe
realip.exe
4⤵
- Executes dropped EXE
PID:2804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
2⤵
PID:4232

C:\Windows\SysWOW64\catroot3\rutserv.exe
C:\Windows\SysWOW64\catroot3\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Filesize
300B

MD5
1be5f89c2ec3a0773a90a8d38b113369

SHA1
a0d210dcf4a9b77caa85e9d7a4f2943014b59398

SHA256
1952973bd68909b1fbd7d2bf52f08f97729db266a7c8cfff14db31a640c43cba

SHA512
56efb1215fe8c207e77f37a3c4bd0e064b5d8e0dc27d186b610f52b7c27988a49b028f63a3c4b9140f426b0cc6258172900e97a938c3edb6103d997e16bc8359

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookDrv.dll
Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookLib.dll
Filesize
42KB

MD5
9b2e0db7547afab728ec31b7288705d6

SHA1
cedd09c5fda6c9445d191f97034e23e960361074

SHA256
ff44a0fe9d27fc3c1f455b2b9e989235ea55be4b95ed569be4b15129e624214b

SHA512
1c4c5eb672541a0fd39ed1174bdd3533e136233bd904c2e8bc7ffcab4f3e9835cbc357a66c6704619795ce983ce57a6a8a206aa922addfcc771dd14c277cdf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest
Filesize
1KB

MD5
d34b3da03c59f38a510eaa8ccc151ec7

SHA1
41b978588a9902f5e14b2b693973cb210ed900b2

SHA256
a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc

SHA512
231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PushSource.ax
Filesize
448KB

MD5
d7eb741be9c97a6d1063102f0e4ca44d

SHA1
bf8bdca7f56ed39fb96141ae9593dec497f4e2c8

SHA256
0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7

SHA512
cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll
Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RWLN.dll
Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.dll
Filesize
120KB

MD5
724cae63522f6e5f7565a3bf4b2a719b

SHA1
18620dbd4357d85918070f669ff4b61755290757

SHA256
b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779

SHA512
af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.exe
Filesize
112KB

MD5
31f84e433e8d1865e322998a41e6d90e

SHA1
cbea6cda10db869636f57b1cffad39b22e6f7f17

SHA256
aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e

SHA512
7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.lib
Filesize
2KB

MD5
3cd3cffda2b5108e2778f94429c624d6

SHA1
3e4d218d1b8eb4fa1ab5152b126951892aff3dc9

SHA256
b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff

SHA512
c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\block_reader.sys
Filesize
1KB

MD5
b5a0cfd3e6cb42a29255faa1546f420c

SHA1
c55cb0f7b5a04231607498b83629e70105113ee3

SHA256
a2d200514887c6f05c9e6150b57cf4541c4923b857cf15723454885b9353dff0

SHA512
274a7371f1d75803926380fd10c60c9aa1bb1088594e3e0be5db255bb9f31ae178e8f79ba4b2deb49c24289dea5b17d1244c873e038d0a94159252ab62f4342e

Download Submit
C:\Users\Admin\AppData\Local\Temp\de.exe
Filesize
98KB

MD5
b8622a3042d7fa48b2e6de433007c870

SHA1
6399b9d115c3f1d3c5469f81b1a821bf75b75ae8

SHA256
cdb8330b9a36462dad63fb5c98520c4dd1cecf8a20d071bb0eff15ecf9fe0c98

SHA512
19450e826c78cc9526bf9ccba356fa63c8282ae3093db9ad71c1f21bcd80b3850b3aabbd2221fd6ddc293378df3d52ac0484c8882aeee517145d018ce3b4ed73

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll
Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll
Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll
Filesize
1.6MB

MD5
086a9fd9179aad7911561eeff08cf7e2

SHA1
d390c28376e08769a06a4a8b46609b3a668f728b

SHA256
2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

SHA512
a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
5KB

MD5
e280695a8c0d2cd7d89e7c10ed49078a

SHA1
54a0ae786ca19bbe23801364b8ecf8208e5bbf11

SHA256
6f4666cbfb57a397b2a9868731a049f6a70dc8e082d275022a95fe78efcd7a36

SHA512
8f1148dbf03d5efc6f724fa86a12f452cd5f8b01a9342ec4ff291ec4172afeda8a11f8aa1953e2e79a4e4dc8ea1d9964843bde79450504e25f4967d36ae1c6fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr.exe
Filesize
3.2MB

MD5
4e92ba65478f7178d64b27fff889c27a

SHA1
46f40f8de8c7df06b35cf2136aae5c541085154d

SHA256
23b14703b23dd44c77a47a846c05aebb466d32d0f52de819e2a2aa002314f085

SHA512
50787831327a18f126860ace5d8b75acd27cc06fb76fb06ca42f90796c72e3574f656573ea64334ee825dfdfe20ba5f4def867f158a41887a7adb24714b93467

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr.exe
Filesize
3.2MB

MD5
4e92ba65478f7178d64b27fff889c27a

SHA1
46f40f8de8c7df06b35cf2136aae5c541085154d

SHA256
23b14703b23dd44c77a47a846c05aebb466d32d0f52de819e2a2aa002314f085

SHA512
50787831327a18f126860ace5d8b75acd27cc06fb76fb06ca42f90796c72e3574f656573ea64334ee825dfdfe20ba5f4def867f158a41887a7adb24714b93467

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr.ini
Filesize
238B

MD5
2a80d7e3da38d8a0fa315e4d20978273

SHA1
6d8b8605d525b228b516f03be767414573f4e6a0

SHA256
fd003e9bb9ea10372149f723685837d68ddd0c717323ca1d90c129d32daffeac

SHA512
cb21f9a8a562ba47767916b5105d1421ee07c6420280298be134bd7a9b9ff41eee2f6af4b1423bf83591ffd768e3fccaa5b2a388f34b4e61f8d620b8ce98d699

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp80.dll
Filesize
541KB

MD5
8c53ccd787c381cd535d8dcca12584d8

SHA1
bc7ce60270a58450596aa3e3e5d0a99f731333d9

SHA256
384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

SHA512
e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcr80.dll
Filesize
617KB

MD5
1169436ee42f860c7db37a4692b38f0e

SHA1
4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

SHA256
9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

SHA512
e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\realip.exe
Filesize
40KB

MD5
effa4a5a70423867665d2a46348ecb26

SHA1
8596bef191ed40ade5980abf0158dfd3d193c352

SHA256
03b86eeff30d769e062a3228a0fb3ce6f0f8911093cd2a4a70cade34896f568d

SHA512
d94e48e1722d4814862d78f35800b4d8eff8f17be4902cbe0d2f0355fd3279faa9a403f3e4bb7ed70b44ace8dbb76b65b7c9f6e9ccf17c69e4d17e0895b8dfff

Download Submit
C:\Users\Admin\AppData\Local\Temp\realip.exe
Filesize
40KB

MD5
effa4a5a70423867665d2a46348ecb26

SHA1
8596bef191ed40ade5980abf0158dfd3d193c352

SHA256
03b86eeff30d769e062a3228a0fb3ce6f0f8911093cd2a4a70cade34896f568d

SHA512
d94e48e1722d4814862d78f35800b4d8eff8f17be4902cbe0d2f0355fd3279faa9a403f3e4bb7ed70b44ace8dbb76b65b7c9f6e9ccf17c69e4d17e0895b8dfff

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
Filesize
2.8MB

MD5
a90c6e72a9e2602560c521a1647664ad

SHA1
22f7f0ddb0af04df7109c3ddbb7027909041fa73

SHA256
579e5984ad5eb6e5e4b004acd01c95f609a1330f3900cd9851562eb4ac879197

SHA512
fbba623cab28c0648e8bdd03c99df9e2a84180d72ea8e63367e943f8b432ebc36a7e10a8bfce11ad1803e54a8514f1ded4fec72e680ee04386965b5eb6a5d6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.reg
Filesize
22KB

MD5
bd9b23bc70c0e08dccb252c0cba92e0a

SHA1
420b4175b0cb870c20839ff55f7d044f54455cdf

SHA256
47181b82869e0aa1818621e9783640bc47bc6e8a6f355648e8595a367c4316d0

SHA512
7abcb40545f493573f4c3a8bcd4cfb1114de9c6e3ea690e4551d44f360672a9b8e1ca4551dae847e864f11a5cde28caed1e6d730cb6c6b26bd918f07b9c78d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\stop.js
Filesize
215B

MD5
804b35ef108ec9839eb6a9335add8ca1

SHA1
bf91e6645c4a1c8cab2d20388469da9ed0a82d56

SHA256
fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406

SHA512
822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d

Download Submit
C:\Windows\SysWOW64\catroot3\HookDrv.dll
Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Windows\SysWOW64\catroot3\RIPCServer.dll
Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Windows\SysWOW64\catroot3\RWLN.dll
Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Windows\SysWOW64\catroot3\dsfOggMux.dll
Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll
Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll
Filesize
1.6MB

MD5
086a9fd9179aad7911561eeff08cf7e2

SHA1
d390c28376e08769a06a4a8b46609b3a668f728b

SHA256
2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

SHA512
a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

Download Submit
C:\Windows\SysWOW64\catroot3\msvcp80.dll
Filesize
541KB

MD5
8c53ccd787c381cd535d8dcca12584d8

SHA1
bc7ce60270a58450596aa3e3e5d0a99f731333d9

SHA256
384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

SHA512
e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

Download Submit
C:\Windows\SysWOW64\catroot3\msvcr80.dll
Filesize
617KB

MD5
1169436ee42f860c7db37a4692b38f0e

SHA1
4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

SHA256
9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

SHA512
e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

Download Submit
C:\Windows\SysWOW64\catroot3\rfusclient.exe
Filesize
2.8MB

MD5
a90c6e72a9e2602560c521a1647664ad

SHA1
22f7f0ddb0af04df7109c3ddbb7027909041fa73

SHA256
579e5984ad5eb6e5e4b004acd01c95f609a1330f3900cd9851562eb4ac879197

SHA512
fbba623cab28c0648e8bdd03c99df9e2a84180d72ea8e63367e943f8b432ebc36a7e10a8bfce11ad1803e54a8514f1ded4fec72e680ee04386965b5eb6a5d6c2

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe
Filesize
3.2MB

MD5
62dbd11dc36780e35af1aafaa6a8f0f1

SHA1
dc6aaac7171b351be3397c3e0e1769dffa848723

SHA256
b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

SHA512
b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\rversionlib.dll
Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Windows\SysWOW64\catroot3\set.reg
Filesize
22KB

MD5
bd9b23bc70c0e08dccb252c0cba92e0a

SHA1
420b4175b0cb870c20839ff55f7d044f54455cdf

SHA256
47181b82869e0aa1818621e9783640bc47bc6e8a6f355648e8595a367c4316d0

SHA512
7abcb40545f493573f4c3a8bcd4cfb1114de9c6e3ea690e4551d44f360672a9b8e1ca4551dae847e864f11a5cde28caed1e6d730cb6c6b26bd918f07b9c78d32

Download Submit
C:\Windows\SysWOW64\de.exe
Filesize
98KB

MD5
b8622a3042d7fa48b2e6de433007c870

SHA1
6399b9d115c3f1d3c5469f81b1a821bf75b75ae8

SHA256
cdb8330b9a36462dad63fb5c98520c4dd1cecf8a20d071bb0eff15ecf9fe0c98

SHA512
19450e826c78cc9526bf9ccba356fa63c8282ae3093db9ad71c1f21bcd80b3850b3aabbd2221fd6ddc293378df3d52ac0484c8882aeee517145d018ce3b4ed73

Download Submit
memory/228-221-0x00000000008E0000-0x0000000000938000-memory.dmp

Filesize
352KB

Download
memory/228-217-0x0000000000000000-mapping.dmp

Download
memory/628-174-0x0000000000000000-mapping.dmp

Download
memory/860-179-0x0000000000000000-mapping.dmp

Download
memory/1128-190-0x0000000000000000-mapping.dmp

Download
memory/1180-205-0x0000000000000000-mapping.dmp

Download
memory/1204-180-0x0000000000000000-mapping.dmp

Download
memory/1212-165-0x0000000000000000-mapping.dmp

Download
memory/1248-191-0x0000000000000000-mapping.dmp

Download
memory/1272-159-0x0000000000000000-mapping.dmp

Download
memory/1452-187-0x0000000000000000-mapping.dmp

Download
memory/1468-207-0x0000000000000000-mapping.dmp

Download
memory/1600-175-0x0000000000000000-mapping.dmp

Download
memory/2068-204-0x0000000000000000-mapping.dmp

Download
memory/2172-192-0x0000000000000000-mapping.dmp

Download
memory/2180-132-0x0000000000000000-mapping.dmp

Download
memory/2216-178-0x0000000000000000-mapping.dmp

Download
memory/2232-188-0x0000000000000000-mapping.dmp

Download
memory/2236-228-0x0000000000C60000-0x0000000000CB8000-memory.dmp

Filesize
352KB

Download
memory/2236-224-0x0000000000000000-mapping.dmp

Download
memory/2256-208-0x0000000000000000-mapping.dmp

Download
memory/2532-197-0x0000000000000000-mapping.dmp

Download
memory/2544-182-0x0000000000000000-mapping.dmp

Download
memory/2628-183-0x0000000000000000-mapping.dmp

Download
memory/2804-243-0x0000000000000000-mapping.dmp

Download
memory/2804-245-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2812-140-0x0000000000000000-mapping.dmp

Download
memory/2876-171-0x0000000000000000-mapping.dmp

Download
memory/2936-177-0x0000000000000000-mapping.dmp

Download
memory/3040-200-0x0000000000000000-mapping.dmp

Download
memory/3048-196-0x0000000000000000-mapping.dmp

Download
memory/3056-209-0x0000000000000000-mapping.dmp

Download
memory/3176-135-0x0000000000000000-mapping.dmp

Download
memory/3252-173-0x0000000000000000-mapping.dmp

Download
memory/3268-161-0x0000000000000000-mapping.dmp

Download
memory/3340-186-0x0000000000000000-mapping.dmp

Download
memory/3448-203-0x0000000000000000-mapping.dmp

Download
memory/3472-157-0x0000000000000000-mapping.dmp

Download
memory/3568-198-0x0000000000000000-mapping.dmp

Download
memory/3684-169-0x0000000000000000-mapping.dmp

Download
memory/3960-136-0x0000000000000000-mapping.dmp

Download
memory/3968-139-0x0000000000000000-mapping.dmp

Download
memory/4064-195-0x0000000000000000-mapping.dmp

Download
memory/4176-181-0x0000000000000000-mapping.dmp

Download
memory/4232-137-0x0000000000000000-mapping.dmp

Download
memory/4268-194-0x0000000000000000-mapping.dmp

Download
memory/4328-185-0x0000000000000000-mapping.dmp

Download
memory/4340-199-0x0000000000000000-mapping.dmp

Download
memory/4408-141-0x0000000000000000-mapping.dmp

Download
memory/4456-193-0x0000000000000000-mapping.dmp

Download
memory/4464-202-0x0000000000000000-mapping.dmp

Download
memory/4472-163-0x0000000000000000-mapping.dmp

Download
memory/4484-241-0x0000000000000000-mapping.dmp

Download
memory/4488-222-0x0000000000000000-mapping.dmp

Download
memory/4524-201-0x0000000000000000-mapping.dmp

Download
memory/4564-189-0x0000000000000000-mapping.dmp

Download
memory/4676-206-0x0000000000000000-mapping.dmp

Download
memory/4736-167-0x0000000000000000-mapping.dmp

Download
memory/5008-184-0x0000000000000000-mapping.dmp

Download