rms | b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0

Analysis

max time kernel
165s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe
Size 2.3MB
Sample221205-hw2knafe96
SHA256 b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0
MD5 1c325867a3bc061416ecbd299cfe3bea
SHA1 ddbaf9c99638552618f07766fb2874c6cb9c689d
SHA512 80e5621f29f4bf9642a8fa4b10310eb62f52d27fcbce2d79886a1448e04082d42d5a3e2dfc333149c73bbd60024e24f530f5e90855f8f662276c06ad2597bdb6
SSDEEP 49152:QAJYZmA562y6sq82PQyN8XEPkNVGsbYGDEPwRk33O8RQRhBrTG0yXeF1F/8gfaoE:7JYYA562yn4OVeMswRkfqFTG0UI/xfaF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 6 IoCs

pid	Process
4976	svchoct.exe
364	svchoct.exe
4980	svchoct.exe
4256	svchoct.exe
4952	Explorernt.exe
3940	Explorernt.exe

Modifies Windows Firewall 1 TTPs 8 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1856	netsh.exe
4168	netsh.exe
3068	netsh.exe
3036	netsh.exe
3708	netsh.exe
2412	netsh.exe
3152	netsh.exe
5104	netsh.exe

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3816	attrib.exe
4908	attrib.exe
4900	attrib.exe
4888	attrib.exe
3848	attrib.exe
596	attrib.exe
2484	attrib.exe
4872	attrib.exe
4456	attrib.exe
3632	attrib.exe
692	attrib.exe
3628	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 12 IoCs

pid	Process
4976	svchoct.exe
4976	svchoct.exe
364	svchoct.exe
364	svchoct.exe
4980	svchoct.exe
4980	svchoct.exe
4256	svchoct.exe
4256	svchoct.exe
4952	Explorernt.exe
4952	Explorernt.exe
3940	Explorernt.exe
3940	Explorernt.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 5 IoCs

evasion

pid	Process
4928	taskkill.exe
4960	taskkill.exe
372	taskkill.exe
1784	taskkill.exe
8	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2600	reg.exe
2152	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3024	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4256	svchoct.exe
4256	svchoct.exe
4256	svchoct.exe
4256	svchoct.exe
4952	Explorernt.exe
4952	Explorernt.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	4976	svchoct.exe
Token: SeDebugPrivilege	4980	svchoct.exe
Token: SeTakeOwnershipPrivilege	4256	svchoct.exe
Token: SeTcbPrivilege	4256	svchoct.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1504	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	77
PID 4868 wrote to memory of 1504	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	77
PID 4868 wrote to memory of 1504	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	77
PID 1504 wrote to memory of 808	1504	WScript.exe	80
PID 1504 wrote to memory of 808	1504	WScript.exe	80
PID 1504 wrote to memory of 808	1504	WScript.exe	80
PID 4868 wrote to memory of 4656	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	82
PID 4868 wrote to memory of 4656	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	82
PID 4868 wrote to memory of 4656	4868	b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe	82
PID 808 wrote to memory of 4928	808	cmd.exe	84
PID 808 wrote to memory of 4928	808	cmd.exe	84
PID 808 wrote to memory of 4928	808	cmd.exe	84
PID 808 wrote to memory of 4960	808	cmd.exe	85
PID 808 wrote to memory of 4960	808	cmd.exe	85
PID 808 wrote to memory of 4960	808	cmd.exe	85
PID 808 wrote to memory of 4956	808	cmd.exe	86
PID 808 wrote to memory of 4956	808	cmd.exe	86
PID 808 wrote to memory of 4956	808	cmd.exe	86
PID 808 wrote to memory of 2484	808	cmd.exe	87
PID 808 wrote to memory of 2484	808	cmd.exe	87
PID 808 wrote to memory of 2484	808	cmd.exe	87
PID 808 wrote to memory of 3816	808	cmd.exe	88
PID 808 wrote to memory of 3816	808	cmd.exe	88
PID 808 wrote to memory of 3816	808	cmd.exe	88
PID 808 wrote to memory of 4908	808	cmd.exe	89
PID 808 wrote to memory of 4908	808	cmd.exe	89
PID 808 wrote to memory of 4908	808	cmd.exe	89
PID 808 wrote to memory of 4900	808	cmd.exe	90
PID 808 wrote to memory of 4900	808	cmd.exe	90
PID 808 wrote to memory of 4900	808	cmd.exe	90
PID 808 wrote to memory of 4872	808	cmd.exe	91
PID 808 wrote to memory of 4872	808	cmd.exe	91
PID 808 wrote to memory of 4872	808	cmd.exe	91
PID 808 wrote to memory of 4456	808	cmd.exe	92
PID 808 wrote to memory of 4456	808	cmd.exe	92
PID 808 wrote to memory of 4456	808	cmd.exe	92
PID 808 wrote to memory of 4888	808	cmd.exe	93
PID 808 wrote to memory of 4888	808	cmd.exe	93
PID 808 wrote to memory of 4888	808	cmd.exe	93
PID 808 wrote to memory of 3848	808	cmd.exe	94
PID 808 wrote to memory of 3848	808	cmd.exe	94
PID 808 wrote to memory of 3848	808	cmd.exe	94
PID 808 wrote to memory of 3632	808	cmd.exe	95
PID 808 wrote to memory of 3632	808	cmd.exe	95
PID 808 wrote to memory of 3632	808	cmd.exe	95
PID 808 wrote to memory of 692	808	cmd.exe	96
PID 808 wrote to memory of 692	808	cmd.exe	96
PID 808 wrote to memory of 692	808	cmd.exe	96
PID 808 wrote to memory of 596	808	cmd.exe	97
PID 808 wrote to memory of 596	808	cmd.exe	97
PID 808 wrote to memory of 596	808	cmd.exe	97
PID 808 wrote to memory of 3628	808	cmd.exe	98
PID 808 wrote to memory of 3628	808	cmd.exe	98
PID 808 wrote to memory of 3628	808	cmd.exe	98
PID 808 wrote to memory of 1984	808	cmd.exe	99
PID 808 wrote to memory of 1984	808	cmd.exe	99
PID 808 wrote to memory of 1984	808	cmd.exe	99
PID 1984 wrote to memory of 4060	1984	net.exe	100
PID 1984 wrote to memory of 4060	1984	net.exe	100
PID 1984 wrote to memory of 4060	1984	net.exe	100
PID 808 wrote to memory of 372	808	cmd.exe	101
PID 808 wrote to memory of 372	808	cmd.exe	101
PID 808 wrote to memory of 372	808	cmd.exe	101
PID 808 wrote to memory of 1784	808	cmd.exe	102

Views/modifies file attributes 1 TTPs 28 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4872	attrib.exe
596	attrib.exe
4456	attrib.exe
3848	attrib.exe
4248	attrib.exe
4288	attrib.exe
2096	attrib.exe
3872	attrib.exe
3960	attrib.exe
4024	attrib.exe
3628	attrib.exe
2188	attrib.exe
556	attrib.exe
3768	attrib.exe
4908	attrib.exe
4888	attrib.exe
3632	attrib.exe
3816	attrib.exe
444	attrib.exe
4900	attrib.exe
2252	attrib.exe
1800	attrib.exe
1332	attrib.exe
3524	attrib.exe
2484	attrib.exe
692	attrib.exe
3572	attrib.exe
4208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe
"C:\Users\Admin\AppData\Local\Temp\b572ab61e1dff278bb02d448a0d71c6b4e1802e206d3a6edd0fab6ad86e83eb0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im RManServer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im svchoct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4960
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      PID:4956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\System32\catroot3"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows\System32\de.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3628
  - - C:\Windows\SysWOW64\net.exe
      net stop rserver3
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        5⤵
        
        PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rserver3.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im r_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cam_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:8
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\system32\rserver30"
      4⤵
      Views/modifies file attributes
      PID:2252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\SysWOW64\rserver30"
      4⤵
      Views/modifies file attributes
      PID:1800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:3572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2188
  - - C:\Windows\SysWOW64\net.exe
      net stop Telnet
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        5⤵
        
        PID:816
  - - C:\Windows\SysWOW64\sc.exe
      sc config tlntsvr start= disabled
      4⤵
      Launches sc.exe
      PID:4948
  - - C:\Windows\SysWOW64\net.exe
      net stop "Service Host Controller"
      4⤵
      PID:220
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        5⤵
        
        PID:3364
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant /delete
      4⤵
      PID:2300
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        5⤵
        
        PID:696
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn security /f
      4⤵
      PID:3884
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="RealIP"
      4⤵
      Modifies Windows Firewall
      PID:3068
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
      4⤵
      Modifies Windows Firewall
      PID:3036
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Service Host Controller"
      4⤵
      Modifies Windows Firewall
      PID:3708
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
      4⤵
      Modifies Windows Firewall
      PID:2412
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
      4⤵
      Modifies Windows Firewall
      PID:3152
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete portopening tcp 57009
      4⤵
      Modifies Windows Firewall
      PID:5104
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="cam_server"
      4⤵
      Modifies Windows Firewall
      PID:1856
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete portopening tcp 57011 all
      4⤵
      Modifies Windows Firewall
      PID:4168
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
      4⤵
      Modifies registry key
      PID:2600
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
      4⤵
      Modifies registry key
      PID:2152
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
      4⤵
      PID:3644
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /firewall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:364
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s set.reg
      4⤵
      Runs .reg file with regedit
      PID:3024
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /start
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Views/modifies file attributes
      PID:556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Views/modifies file attributes
      PID:4208
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Views/modifies file attributes
      PID:3768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Views/modifies file attributes
      PID:4024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Views/modifies file attributes
      PID:4248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Views/modifies file attributes
      PID:3872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Views/modifies file attributes
      PID:3524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Views/modifies file attributes
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Views/modifies file attributes
      PID:3960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Views/modifies file attributes
      PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  PID:4656

C:\Windows\SysWOW64\catroot3\svchoct.exe
C:\Windows\SysWOW64\catroot3\svchoct.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 300B
SHA256 e1679431c1fc5289c6912e0a704eda7d845337b77313433612b05eae3babe971
MD5 467c6718f6df5c8c072cda4b7e1de52c
SHA1 3344ea283a3be16f69380b84ef61803e218c3671
SHA512 f116bf2f81124fa1a9798ea359a3772bdfd1ce57f3d47a67815c80336602968728ee36533a65a6795e545812baa6bc501aba28e7e5e1991c506dea7eb761a543
MD5 SHA1 SHA512

Submit Download

Explorernt.exe

Path C:\Users\Admin\AppData\Local\Temp\Explorernt.exe
Size 2.8MB
SHA256 74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36
MD5 a0924820769909ca25e9eea948b7d8ad
SHA1 e70e1a1662a4fe966e38218beb777516c3db4e37
SHA512 e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073
SSDEEP 49152:QmG6nzSTLQynAc4oitsUj17bFhNyY5TGQnMICiddx:QmGPLTuoiDnrZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HookDrv.dll

Path C:\Users\Admin\AppData\Local\Temp\HookDrv.dll
Size 144KB
SHA256 02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e
MD5 513066a38057079e232f5f99baef2b94
SHA1 a6da9e87415b8918447ec361ba98703d12b4ee76
SHA512 83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5
SSDEEP 3072:WE31FfaUrIM5iCO11Qh4s1qLm7ztS/0LFJyvgZAVDqse:WE3bTrIZHZi78/mFJH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc
MD5 d34b3da03c59f38a510eaa8ccc151ec7
SHA1 41b978588a9902f5e14b2b693973cb210ed900b2
SHA512 231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7
MD5 SHA1 SHA512

Submit Download

PushSource.ax

Path C:\Users\Admin\AppData\Local\Temp\PushSource.ax
Size 448KB
SHA256 0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7
MD5 d7eb741be9c97a6d1063102f0e4ca44d
SHA1 bf8bdca7f56ed39fb96141ae9593dec497f4e2c8
SHA512 cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e
SSDEEP 12288:SQwLjD6RoFxOsSyGiL39888888888888W88888888888:+j+RoFxOs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

RIPCServer.dll

Path C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll
Size 96KB
SHA256 24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844
MD5 329354f10504d225384e19c8c1c575db
SHA1 9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66
SHA512 876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e
SSDEEP 1536:FmkHcmHFtBJPtyii8Pywn0aA8O0OxWZZiliPvkxndZNrb7:gkHVRmYRTO3MnYdZNf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfOggMux.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll
Size 84KB
SHA256 ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e
MD5 65889701199e41ae2abee652a232af6e
SHA1 3f76c39fde130b550013a4f13bfea2862b5628cf
SHA512 edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5
SSDEEP 1536:Yv53t9OUu7EzZX7tHiDrasYb2jdNj4OgLDEzf4:Yv599OUuwzZlcrasw2jdN0OgLD84
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfTheoraEncoder.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll
Size 240KB
SHA256 f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f
MD5 5f2fc8a0d96a1e796a4daae9465f5dd6
SHA1 224f13f3cbaa441c0cb6d6300715fda7136408ea
SHA512 da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad
SSDEEP 3072:CGqLgUQzyZTXg7nO2kIVA41cweQXrDRX5GBVE3NPEc8Vf1Uk58R9aAwQfzlLd07C:NOQzPO2kwwwXXSHEtlsaXucOjFDIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfVorbisEncoder.dll

Path C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll
Size 1.6MB
SHA256 2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282
MD5 086a9fd9179aad7911561eeff08cf7e2
SHA1 d390c28376e08769a06a4a8b46609b3a668f728b
SHA512 a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193
SSDEEP 6144:+Je5f8/yevmbiW/cV+kcBGWzR0FZOAoDG:pJ8/yevmbiSckno
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 5KB
SHA256 e61b80f090c29a367f6ab31602da917a9d67a1be5ef0d758f258b792e219913c
MD5 0bc7d3a303e0c6d7d84f1db5d5efef43
SHA1 93bc6ca6f770ec2c6f99a5bb3d482fd029bc2c63
SHA512 b5e801510b8464fc387521853fb09174ce16d54e70bd0d145d717f965e6df04fcfea4a6687c2ae8ac3f95d59ed6027fb7a337b50d962f0aaeed71d85219b8d24
SSDEEP 96:A0ycyhhjuhZZqdfybhUUOeLs5+UsuHMHq48bwkYZf82iTn9dsrsjsDvPA:A0hejIZodfEUUOQ8fa8bTu83
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp80.dll
Size 541KB
SHA256 384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
MD5 8c53ccd787c381cd535d8dcca12584d8
SHA1 bc7ce60270a58450596aa3e3e5d0a99f731333d9
SHA512 e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755
SSDEEP 12288:UZY4lOHMwLwXBt+ia3htSUa/hUgiW6QR7t5j3Ooc8NHkC2eSQ:UZY4lOHMM8wiShtSj3Ooc8NHkC2eT
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcr80.dll
Size 617KB
SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
MD5 1169436ee42f860c7db37a4692b38f0e
SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
SSDEEP 12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Users\Admin\AppData\Local\Temp\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

set.reg

Path C:\Users\Admin\AppData\Local\Temp\set.reg
Size 12KB
SHA256 564f9a4cf6581b38bc0360fff19c26df062344444b8b60ddfe86eb0194269e74
MD5 26554b7c1085b248da68c14d6437ba18
SHA1 0c55725c7f9295c2c4b69719fb98736e66658606
SHA512 99b110a73875ffa59b56f50e4e10e6c28c390fcdd285f19bc7b238329b870eca322b47619f4e1181c3737f011df738fdddee01b1b654266405b2a31003075135
SSDEEP 384:IHcQoG3t2f5etUmCLCJ1j6kpETt5aENBJsjxqTIpBpG7PRmH6emO:IHcQJtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

stop.js

Path C:\Users\Admin\AppData\Local\Temp\stop.js
Size 215B
SHA256 fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406
MD5 804b35ef108ec9839eb6a9335add8ca1
SHA1 bf91e6645c4a1c8cab2d20388469da9ed0a82d56
SHA512 822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d
MD5 SHA1 SHA512

Submit Download

svchoct.exe

Path C:\Users\Admin\AppData\Local\Temp\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Explorernt.exe

Path C:\Windows\SysWOW64\catroot3\Explorernt.exe
Size 2.8MB
SHA256 74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36
MD5 a0924820769909ca25e9eea948b7d8ad
SHA1 e70e1a1662a4fe966e38218beb777516c3db4e37
SHA512 e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073
SSDEEP 49152:QmG6nzSTLQynAc4oitsUj17bFhNyY5TGQnMICiddx:QmGPLTuoiDnrZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Explorernt.exe

Path C:\Windows\SysWOW64\catroot3\Explorernt.exe
Size 2.8MB
SHA256 74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36
MD5 a0924820769909ca25e9eea948b7d8ad
SHA1 e70e1a1662a4fe966e38218beb777516c3db4e37
SHA512 e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073
SSDEEP 49152:QmG6nzSTLQynAc4oitsUj17bFhNyY5TGQnMICiddx:QmGPLTuoiDnrZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Explorernt.exe

Path C:\Windows\SysWOW64\catroot3\Explorernt.exe
Size 2.8MB
SHA256 74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36
MD5 a0924820769909ca25e9eea948b7d8ad
SHA1 e70e1a1662a4fe966e38218beb777516c3db4e37
SHA512 e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073
SSDEEP 49152:QmG6nzSTLQynAc4oitsUj17bFhNyY5TGQnMICiddx:QmGPLTuoiDnrZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HookDrv.dll

Path C:\Windows\SysWOW64\catroot3\HookDrv.dll
Size 144KB
SHA256 02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e
MD5 513066a38057079e232f5f99baef2b94
SHA1 a6da9e87415b8918447ec361ba98703d12b4ee76
SHA512 83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5
SSDEEP 3072:WE31FfaUrIM5iCO11Qh4s1qLm7ztS/0LFJyvgZAVDqse:WE3bTrIZHZi78/mFJH
MD5 SHA1 SHA512 SSDEEP

Submit Download

RIPCServer.dll

Path C:\Windows\SysWOW64\catroot3\RIPCServer.dll
Size 96KB
SHA256 24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844
MD5 329354f10504d225384e19c8c1c575db
SHA1 9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66
SHA512 876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e
SSDEEP 1536:FmkHcmHFtBJPtyii8Pywn0aA8O0OxWZZiliPvkxndZNrb7:gkHVRmYRTO3MnYdZNf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfOggMux.dll

Path C:\Windows\SysWOW64\catroot3\dsfOggMux.dll
Size 84KB
SHA256 ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e
MD5 65889701199e41ae2abee652a232af6e
SHA1 3f76c39fde130b550013a4f13bfea2862b5628cf
SHA512 edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5
SSDEEP 1536:Yv53t9OUu7EzZX7tHiDrasYb2jdNj4OgLDEzf4:Yv599OUuwzZlcrasw2jdN0OgLD84
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfTheoraEncoder.dll

Path C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll
Size 240KB
SHA256 f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f
MD5 5f2fc8a0d96a1e796a4daae9465f5dd6
SHA1 224f13f3cbaa441c0cb6d6300715fda7136408ea
SHA512 da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad
SSDEEP 3072:CGqLgUQzyZTXg7nO2kIVA41cweQXrDRX5GBVE3NPEc8Vf1Uk58R9aAwQfzlLd07C:NOQzPO2kwwwXXSHEtlsaXucOjFDIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsfVorbisEncoder.dll

Path C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll
Size 1.6MB
SHA256 2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282
MD5 086a9fd9179aad7911561eeff08cf7e2
SHA1 d390c28376e08769a06a4a8b46609b3a668f728b
SHA512 a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193
SSDEEP 6144:+Je5f8/yevmbiW/cV+kcBGWzR0FZOAoDG:pJ8/yevmbiSckno
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp80.dll

Path C:\Windows\SysWOW64\catroot3\msvcp80.dll
Size 541KB
SHA256 384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
MD5 8c53ccd787c381cd535d8dcca12584d8
SHA1 bc7ce60270a58450596aa3e3e5d0a99f731333d9
SHA512 e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755
SSDEEP 12288:UZY4lOHMwLwXBt+ia3htSUa/hUgiW6QR7t5j3Ooc8NHkC2eSQ:UZY4lOHMM8wiShtSj3Ooc8NHkC2eT
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr80.dll

Path C:\Windows\SysWOW64\catroot3\msvcr80.dll
Size 617KB
SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
MD5 1169436ee42f860c7db37a4692b38f0e
SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
SSDEEP 12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rversionlib.dll

Path C:\Windows\SysWOW64\catroot3\rversionlib.dll
Size 310KB
SHA256 1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d
MD5 3f95a06f40eaf51b86cef2bf036ebd7a
SHA1 64009c5f79661eb2f82c9a76a843c0d3a856695d
SHA512 6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897
SSDEEP 6144:Q29Kct7IGU5WKCLylAmI+CEanMTYFyKroUYS6oFv:Q2vt7IGU4KCLya+CM8Fbr9YS6mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

set.reg

Path C:\Windows\SysWOW64\catroot3\set.reg
Size 12KB
SHA256 564f9a4cf6581b38bc0360fff19c26df062344444b8b60ddfe86eb0194269e74
MD5 26554b7c1085b248da68c14d6437ba18
SHA1 0c55725c7f9295c2c4b69719fb98736e66658606
SHA512 99b110a73875ffa59b56f50e4e10e6c28c390fcdd285f19bc7b238329b870eca322b47619f4e1181c3737f011df738fdddee01b1b654266405b2a31003075135
SSDEEP 384:IHcQoG3t2f5etUmCLCJ1j6kpETt5aENBJsjxqTIpBpG7PRmH6emO:IHcQJtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchoct.exe

Path C:\Windows\SysWOW64\catroot3\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchoct.exe

Path C:\Windows\SysWOW64\catroot3\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchoct.exe

Path C:\Windows\SysWOW64\catroot3\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchoct.exe

Path C:\Windows\SysWOW64\catroot3\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchoct.exe

Path C:\Windows\SysWOW64\catroot3\svchoct.exe
Size 3.2MB
SHA256 502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac
MD5 8ae3deecb2b1f16a7adcf3aeaffb487d
SHA1 0370c0e6b81dea9df7737923cfe36aebdd1623b6
SHA512 59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5
SSDEEP 49152:EN0bCGfSU5AGMfdpDXXR6+ju3cHTFilnut1rfkvIklO90T/TvogiL8s5ddx:EN68runuzrfkvjO0iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-209-0x0000000000D60000-0x0000000000DB8000-memory.dmp

Download

memory/3940-238-0x0000000000870000-0x00000000008C8000-memory.dmp

Download

memory/4256-220-0x0000000000920000-0x0000000000978000-memory.dmp

Download

memory/4952-235-0x00000000008E0000-0x0000000000938000-memory.dmp

Download

memory/4980-216-0x0000000000DB0000-0x0000000000E08000-memory.dmp

Download