rms | 5874294f3f7c4fe472b836c5b96262a44a5a42f96e186f11cce4777d1ad9688d

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2023 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe
Size

17.0MB
MD5

46fb7cafdf2dbb555201cfaaf104c1d3
SHA1

2eb1b934a6928eaa63f48f63888f690765968035
SHA256

da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f
SHA512

bbaa2692aa0c84b10417daa04434f72b54e137be85042368c58432a7a39d40e4405246b2ecd6d9be1a7f3f6ef15f5f9d2ab8d31b4eee90839587e29c82e1a1e8
SSDEEP

393216:vuDuvtZSalmqJLNWqezyawPNbD7aC558YgrurVniy/+Rv:FvtZdbMGawPNb6E/rVjWRv

Score

10^/10

rms rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/448-133-0x0000000000400000-0x0000000002917000-memory.dmp	upx
behavioral2/memory/448-214-0x0000000000400000-0x0000000002917000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exerutserv.exerfusclient.exeda301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe

Drops file in System32 directory 8 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_DDC6638534E8608691DE0CEAFF22DE0F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_DDC6638534E8608691DE0CEAFF22DE0F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe

Executes dropped EXE 4 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerfusclient.exe

pid process

4360 rfusclient.exe
5020 rutserv.exe
3788 rutserv.exe
2676 rfusclient.exe
Loads dropped DLL 4 IoCs

Processes:

rutserv.exerutserv.exe

pid process

5020 rutserv.exe
5020 rutserv.exe
3788 rutserv.exe
3788 rutserv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5020	rutserv.exe
5020	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerfusclient.exe

pid	process
4360	rfusclient.exe
4360	rfusclient.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
2676	rfusclient.exe
2676	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rutserv.exerutserv.exe

description	pid	process
Token: SeDebugPrivilege	5020	rutserv.exe
Token: SeTakeOwnershipPrivilege	3788	rutserv.exe
Token: SeTcbPrivilege	3788	rutserv.exe
Token: SeTcbPrivilege	3788	rutserv.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

rfusclient.exe

pid process

2676 rfusclient.exe
2676 rfusclient.exe
2676 rfusclient.exe
2676 rfusclient.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

rfusclient.exe

pid process

2676 rfusclient.exe
2676 rfusclient.exe
2676 rfusclient.exe
2676 rfusclient.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

rutserv.exerutserv.exe

pid process

5020 rutserv.exe
5020 rutserv.exe
5020 rutserv.exe
5020 rutserv.exe
3788 rutserv.exe
3788 rutserv.exe
3788 rutserv.exe
3788 rutserv.exe
3788 rutserv.exe

pid	process
2676	rfusclient.exe
2676	rfusclient.exe
2676	rfusclient.exe
2676	rfusclient.exe

pid	process
2676	rfusclient.exe
2676	rfusclient.exe
2676	rfusclient.exe
2676	rfusclient.exe

pid	process
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe
3788	rutserv.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exerfusclient.exerutserv.exe

description	pid	process	target process
PID 448 wrote to memory of 4360	448	da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe	rfusclient.exe
PID 448 wrote to memory of 4360	448	da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe	rfusclient.exe
PID 448 wrote to memory of 4360	448	da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe	rfusclient.exe
PID 4360 wrote to memory of 5020	4360	rfusclient.exe	rutserv.exe
PID 4360 wrote to memory of 5020	4360	rfusclient.exe	rutserv.exe
PID 4360 wrote to memory of 5020	4360	rfusclient.exe	rutserv.exe
PID 3788 wrote to memory of 2676	3788	rutserv.exe	rfusclient.exe
PID 3788 wrote to memory of 2676	3788	rutserv.exe	rfusclient.exe
PID 3788 wrote to memory of 2676	3788	rutserv.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe
"C:\Users\Admin\AppData\Local\Temp\da301d359b4bbbc07ed41da725cc33e21a23a1e68f69436b475e37ab6abbf52f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe" -run_agent
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360

C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe" -run_agent
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe" -run_agent -second
4⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788

C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe" /tray /user
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\EULA.rtf
Filesize
133KB

MD5
7fd09e69fa62629a04d1e23bb8ca5ff6

SHA1
3952c5f339c8bbdf17aff113bcb0149ac8ce4fa6

SHA256
f9c56736029b7d278bf8fabc6e0f5bdac67e24b088f2172ea07df2baa3072c19

SHA512
e66d523eb5bdfc517749b608ffcd66b883be9c4b8c5c42dbf7e48fe412a5c0ca0876d0dbc8a68355e7bb532ce8749c5e444a25f996b4c27e382e79579ab2b59a

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\branding.ini
Filesize
282B

MD5
a710f70847e4dfd93b194c5de05bbe47

SHA1
807a625da735e366677f60a5e6429c0b05e1c77f

SHA256
5d1d5eb82063d4268c0a460f832606313af023d98ab28cde6004f2bcc2d3199f

SHA512
3910dcae494bee18a75ed4862ce37aef50404766d2107a9b0f3cbfb4847dba31490b96578be79f5f618cf8ea0388a415fb07b9fe63fe2395e767edaa285cec32

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\branding.ini
Filesize
282B

MD5
a710f70847e4dfd93b194c5de05bbe47

SHA1
807a625da735e366677f60a5e6429c0b05e1c77f

SHA256
5d1d5eb82063d4268c0a460f832606313af023d98ab28cde6004f2bcc2d3199f

SHA512
3910dcae494bee18a75ed4862ce37aef50404766d2107a9b0f3cbfb4847dba31490b96578be79f5f618cf8ea0388a415fb07b9fe63fe2395e767edaa285cec32

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\eventmsg.dll
Filesize
51KB

MD5
4e84df6558c385bc781cddea34c9fba3

SHA1
6d63d87c19c11bdbfa484a5835ffffd7647296c8

SHA256
0526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d

SHA512
c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\eventmsg.dll
Filesize
51KB

MD5
4e84df6558c385bc781cddea34c9fba3

SHA1
6d63d87c19c11bdbfa484a5835ffffd7647296c8

SHA256
0526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d

SHA512
c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\libeay32.dll
Filesize
1.3MB

MD5
5222eaf78313758b0520be16e3f8392e

SHA1
9c7cc8fb340618fef38422cf0c75c4c9bfb216e2

SHA256
4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5

SHA512
459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\libeay32.dll
Filesize
1.3MB

MD5
5222eaf78313758b0520be16e3f8392e

SHA1
9c7cc8fb340618fef38422cf0c75c4c9bfb216e2

SHA256
4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5

SHA512
459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\libeay32.dll
Filesize
1.3MB

MD5
5222eaf78313758b0520be16e3f8392e

SHA1
9c7cc8fb340618fef38422cf0c75c4c9bfb216e2

SHA256
4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5

SHA512
459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\libeay32.dll
Filesize
1.3MB

MD5
5222eaf78313758b0520be16e3f8392e

SHA1
9c7cc8fb340618fef38422cf0c75c4c9bfb216e2

SHA256
4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5

SHA512
459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\logo.png
Filesize
19KB

MD5
b47a732e4610d7b776ed25f2ad923a3a

SHA1
9806ae3e98d0ad790c1f57818407383e61bfc5eb

SHA256
3a8a46aa58e86fbe0263e363ab5cb8c3cfd7483c85a5f3e3bdb542976cc853a1

SHA512
5164ceafc96ad4bb1ca935a0ea5a4413298fc0cf00a074e0d49f00ee57d1eb9eebfba6525310ed648b26bde6aeb2083c45c19a87f8b5a8584bbb14ef71834157

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\logo.png
Filesize
19KB

MD5
b47a732e4610d7b776ed25f2ad923a3a

SHA1
9806ae3e98d0ad790c1f57818407383e61bfc5eb

SHA256
3a8a46aa58e86fbe0263e363ab5cb8c3cfd7483c85a5f3e3bdb542976cc853a1

SHA512
5164ceafc96ad4bb1ca935a0ea5a4413298fc0cf00a074e0d49f00ee57d1eb9eebfba6525310ed648b26bde6aeb2083c45c19a87f8b5a8584bbb14ef71834157

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
Filesize
10.2MB

MD5
06208aa91f0f77d6c9b989f65803382a

SHA1
75e37439e6d1537fadf38c758df3a9fb232313cf

SHA256
d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5

SHA512
a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
Filesize
10.2MB

MD5
06208aa91f0f77d6c9b989f65803382a

SHA1
75e37439e6d1537fadf38c758df3a9fb232313cf

SHA256
d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5

SHA512
a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
Filesize
10.2MB

MD5
06208aa91f0f77d6c9b989f65803382a

SHA1
75e37439e6d1537fadf38c758df3a9fb232313cf

SHA256
d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5

SHA512
a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rfusclient.exe
Filesize
10.2MB

MD5
06208aa91f0f77d6c9b989f65803382a

SHA1
75e37439e6d1537fadf38c758df3a9fb232313cf

SHA256
d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5

SHA512
a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
Filesize
19.8MB

MD5
41dc282cbf89b0737ae6dd2de5a71015

SHA1
4aac4bafaf43be690089549584770f9e88630b45

SHA256
b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

SHA512
ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
Filesize
19.8MB

MD5
41dc282cbf89b0737ae6dd2de5a71015

SHA1
4aac4bafaf43be690089549584770f9e88630b45

SHA256
b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

SHA512
ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
Filesize
19.8MB

MD5
41dc282cbf89b0737ae6dd2de5a71015

SHA1
4aac4bafaf43be690089549584770f9e88630b45

SHA256
b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

SHA512
ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\rutserv.exe
Filesize
19.8MB

MD5
41dc282cbf89b0737ae6dd2de5a71015

SHA1
4aac4bafaf43be690089549584770f9e88630b45

SHA256
b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

SHA512
ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\settings.dat
Filesize
9KB

MD5
6a74e0ba44c8cbfd6924349a3f546894

SHA1
59ac6aa2ce8685e4fb42324f9747b61fa02bfdac

SHA256
46f4693be54ee3133c5b7059e025263246999724e84b04bf4c65506e93464b20

SHA512
952adcfcf939155d008a1e70f263408b400a615ddcd32d2c481f365337d7b9fdded0f3f2ee259d035827f68f3766f06e2042a781c919ebfb6120f1505073c14b

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\settings.dat
Filesize
9KB

MD5
6a74e0ba44c8cbfd6924349a3f546894

SHA1
59ac6aa2ce8685e4fb42324f9747b61fa02bfdac

SHA256
46f4693be54ee3133c5b7059e025263246999724e84b04bf4c65506e93464b20

SHA512
952adcfcf939155d008a1e70f263408b400a615ddcd32d2c481f365337d7b9fdded0f3f2ee259d035827f68f3766f06e2042a781c919ebfb6120f1505073c14b

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\ssleay32.dll
Filesize
337KB

MD5
90a4b7fc6807693e68dd32b68614d989

SHA1
785484ef531ca90f323d5b017fefcff05e68093a

SHA256
4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6

SHA512
97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\ssleay32.dll
Filesize
337KB

MD5
90a4b7fc6807693e68dd32b68614d989

SHA1
785484ef531ca90f323d5b017fefcff05e68093a

SHA256
4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6

SHA512
97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\ssleay32.dll
Filesize
337KB

MD5
90a4b7fc6807693e68dd32b68614d989

SHA1
785484ef531ca90f323d5b017fefcff05e68093a

SHA256
4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6

SHA512
97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\ssleay32.dll
Filesize
337KB

MD5
90a4b7fc6807693e68dd32b68614d989

SHA1
785484ef531ca90f323d5b017fefcff05e68093a

SHA256
4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6

SHA512
97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\vp8decoder.dll
Filesize
379KB

MD5
e247666cdea63da5a95aebc135908207

SHA1
4642f6c3973c41b7d1c9a73111a26c2d7ac9c392

SHA256
b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33

SHA512
06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\vp8decoder.dll
Filesize
379KB

MD5
e247666cdea63da5a95aebc135908207

SHA1
4642f6c3973c41b7d1c9a73111a26c2d7ac9c392

SHA256
b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33

SHA512
06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\vp8encoder.dll
Filesize
1.6MB

MD5
d5c2a6ac30e76b7c9b55adf1fe5c1e4a

SHA1
3d841eb48d1a32b511611d4b9e6eed71e2c373ee

SHA256
11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428

SHA512
3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\vp8encoder.dll
Filesize
1.6MB

MD5
d5c2a6ac30e76b7c9b55adf1fe5c1e4a

SHA1
3d841eb48d1a32b511611d4b9e6eed71e2c373ee

SHA256
11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428

SHA512
3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmmux.dll
Filesize
259KB

MD5
49c51ace274d7db13caa533880869a4a

SHA1
b539ed2f1a15e2d4e5c933611d736e0c317b8313

SHA256
1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b

SHA512
13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmmux.dll
Filesize
259KB

MD5
49c51ace274d7db13caa533880869a4a

SHA1
b539ed2f1a15e2d4e5c933611d736e0c317b8313

SHA256
1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b

SHA512
13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmvorbisdecoder.dll
Filesize
364KB

MD5
eda07083af5b6608cb5b7c305d787842

SHA1
d1703c23522d285a3ccdaf7ba2eb837d40608867

SHA256
c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d

SHA512
be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmvorbisdecoder.dll
Filesize
364KB

MD5
eda07083af5b6608cb5b7c305d787842

SHA1
d1703c23522d285a3ccdaf7ba2eb837d40608867

SHA256
c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d

SHA512
be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmvorbisencoder.dll
Filesize
859KB

MD5
642dc7e57f0c962b9db4c8fb346bc5a7

SHA1
acee24383b846f7d12521228d69135e5704546f6

SHA256
63b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede

SHA512
fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\F10DC4E670\webmvorbisencoder.dll
Filesize
859KB

MD5
642dc7e57f0c962b9db4c8fb346bc5a7

SHA1
acee24383b846f7d12521228d69135e5704546f6

SHA256
63b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede

SHA512
fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae

Download Submit
C:\Users\Admin\AppData\Roaming\RMS Agent\Logs\rms_log_2023-05.html
Filesize
5KB

MD5
641a90f4744f20bdec74603c141c269e

SHA1
24f58102f45d5f3b25b225a0f2f8bfb1697ae963

SHA256
2f058c040d3b07f4c42445e9d115c1df0d1504bb6101dbf446940357723a2d5a

SHA512
6fae444b424002a3b05b879e3849138427b108bb291fc6bd53ddf69562e3621fcf884ed0c199f9a953dcd28ea5cc547486e810e1a8ebe84503ce5ff6e64a102b

Download Submit
memory/448-133-0x0000000000400000-0x0000000002917000-memory.dmp

Filesize
37.1MB

Download
memory/448-214-0x0000000000400000-0x0000000002917000-memory.dmp

Filesize
37.1MB

Download
memory/448-154-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/2676-280-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-303-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-321-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-317-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-312-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-309-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-306-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-298-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-293-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-289-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-285-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-276-0x0000000003860000-0x0000000003861000-memory.dmp

Filesize
4KB

Download
memory/2676-275-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2676-261-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/2676-251-0x0000000003860000-0x0000000003861000-memory.dmp

Filesize
4KB

Download
memory/2676-256-0x00000000046C0000-0x00000000046C1000-memory.dmp

Filesize
4KB

Download
memory/2676-255-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/3788-292-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-274-0x0000000003B70000-0x0000000003B71000-memory.dmp

Filesize
4KB

Download
memory/3788-323-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-263-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/3788-319-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-265-0x0000000009310000-0x0000000009311000-memory.dmp

Filesize
4KB

Download
memory/3788-273-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-246-0x0000000007450000-0x0000000007451000-memory.dmp

Filesize
4KB

Download
memory/3788-250-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/3788-297-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-279-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-239-0x00000000068C0000-0x00000000068C1000-memory.dmp

Filesize
4KB

Download
memory/3788-283-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-248-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/3788-287-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-247-0x0000000006A80000-0x0000000006A81000-memory.dmp

Filesize
4KB

Download
memory/3788-264-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/3788-260-0x0000000007C50000-0x0000000007C51000-memory.dmp

Filesize
4KB

Download
memory/3788-249-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/3788-245-0x00000000068B0000-0x00000000068B1000-memory.dmp

Filesize
4KB

Download
memory/3788-301-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-229-0x0000000003B70000-0x0000000003B71000-memory.dmp

Filesize
4KB

Download
memory/3788-305-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-315-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-308-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-241-0x0000000006780000-0x0000000006781000-memory.dmp

Filesize
4KB

Download
memory/3788-311-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/3788-240-0x0000000006A10000-0x0000000006A11000-memory.dmp

Filesize
4KB

Download
memory/4360-219-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/4360-216-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/5020-226-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/5020-224-0x0000000003C30000-0x0000000003C31000-memory.dmp

Filesize
4KB

Download
memory/5020-228-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/5020-225-0x0000000006140000-0x0000000006141000-memory.dmp

Filesize
4KB

Download