rms | 104555eaa2a56782c4357dc3150d865f8d89eeeb5d4933aebc3d7d3d4278bd12

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agent.exe
Size

9.6MB
MD5

f318f33943ac090b9872a8ac4045bedf
SHA1

974da2c9186ca7534a29c9f907cb910668368e5f
SHA256

75fb9e1511f1005f07cd73c8cc836fcdecc645e4a633c48e7816958e7d792d25
SHA512

3c46bf23c1ed51e5acada3f4abcf26199283b879d9da0b5ca9b7e4813084c048aade6378a0282ae4a3708b9fd5aef1dfddbdba476812a087bcadc455ebfc7bd2
SSDEEP

196608:Ph8kqvWOgbU9z8PQ4EXqWkNGC/TkLZ04CTp2CKoojMHXF7lb5ryP1IPJ8czzT:Ph8/vW49zgQ4E6aykl04CkTMhDa+j

Score

10^/10

rms rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exerfusclient.exerutserv.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 5 IoCs

Processes:

rfusclient.exerfusclient.exerutserv.exerutserv.exerfusclient.exe

pid process

2776 rfusclient.exe
1592 rfusclient.exe
1472 rutserv.exe
880 rutserv.exe
2704 rfusclient.exe

pid	process
2776	rfusclient.exe
1592	rfusclient.exe
1472	rutserv.exe
880	rutserv.exe
2704	rfusclient.exe

Loads dropped DLL 10 IoCs

Processes:

agent.exerfusclient.exerfusclient.exe

pid	process
2904	agent.exe
2904	agent.exe
2904	agent.exe
2904	agent.exe
2776	rfusclient.exe
2776	rfusclient.exe
1592	rfusclient.exe
1592	rfusclient.exe
1592	rfusclient.exe
1592	rfusclient.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2904-0-0x0000000000400000-0x0000000000EC5000-memory.dmp	upx
behavioral1/memory/2904-83-0x0000000000400000-0x0000000000EC5000-memory.dmp	upx

Drops file in System32 directory 12 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C987C966D19B79B9D9F35B962FCC8FA	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EB35376744F392396307460D546222D_EC1C46868A78521D3A7ED5209EF9CB19	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C987C966D19B79B9D9F35B962FCC8FA	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EB35376744F392396307460D546222D_EC1C46868A78521D3A7ED5209EF9CB19	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

rutserv.exerutserv.exe

pid process

1472 rutserv.exe
1472 rutserv.exe
1472 rutserv.exe
1472 rutserv.exe
1472 rutserv.exe
880 rutserv.exe
880 rutserv.exe
880 rutserv.exe
880 rutserv.exe

pid	process
1472	rutserv.exe
1472	rutserv.exe
1472	rutserv.exe
1472	rutserv.exe
1472	rutserv.exe
880	rutserv.exe
880	rutserv.exe
880	rutserv.exe
880	rutserv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rutserv.exerutserv.exe

description	pid	process
Token: SeDebugPrivilege	1472	rutserv.exe
Token: SeTakeOwnershipPrivilege	880	rutserv.exe
Token: SeTcbPrivilege	880	rutserv.exe
Token: SeTcbPrivilege	880	rutserv.exe

Suspicious use of FindShellTrayWindow 16 IoCs

Processes:

rfusclient.exe

pid	process
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

rfusclient.exe

pid	process
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe
2704	rfusclient.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

rutserv.exerutserv.exe

pid process

1472 rutserv.exe
1472 rutserv.exe
1472 rutserv.exe
1472 rutserv.exe
880 rutserv.exe
880 rutserv.exe
880 rutserv.exe
880 rutserv.exe

pid	process
1472	rutserv.exe
1472	rutserv.exe
1472	rutserv.exe
1472	rutserv.exe
880	rutserv.exe
880	rutserv.exe
880	rutserv.exe
880	rutserv.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

agent.exerfusclient.exerfusclient.exerutserv.exe

description	pid	process	target process
PID 2904 wrote to memory of 2776	2904	agent.exe	rfusclient.exe
PID 2904 wrote to memory of 2776	2904	agent.exe	rfusclient.exe
PID 2904 wrote to memory of 2776	2904	agent.exe	rfusclient.exe
PID 2904 wrote to memory of 2776	2904	agent.exe	rfusclient.exe
PID 2776 wrote to memory of 1592	2776	rfusclient.exe	rfusclient.exe
PID 2776 wrote to memory of 1592	2776	rfusclient.exe	rfusclient.exe
PID 2776 wrote to memory of 1592	2776	rfusclient.exe	rfusclient.exe
PID 2776 wrote to memory of 1592	2776	rfusclient.exe	rfusclient.exe
PID 1592 wrote to memory of 1472	1592	rfusclient.exe	rutserv.exe
PID 1592 wrote to memory of 1472	1592	rfusclient.exe	rutserv.exe
PID 1592 wrote to memory of 1472	1592	rfusclient.exe	rutserv.exe
PID 1592 wrote to memory of 1472	1592	rfusclient.exe	rutserv.exe
PID 880 wrote to memory of 2704	880	rutserv.exe	rfusclient.exe
PID 880 wrote to memory of 2704	880	rutserv.exe	rfusclient.exe
PID 880 wrote to memory of 2704	880	rutserv.exe	rfusclient.exe
PID 880 wrote to memory of 2704	880	rutserv.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\agent.exe
"C:\Users\Admin\AppData\Local\Temp\agent.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\rfusclient.exe
  "C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\rfusclient.exe" -deploy
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rfusclient.exe
    "C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rfusclient.exe" -run_agent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rutserv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rutserv.exe
        
        C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:880
      - C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rfusclient.exe
        
        C:\Users\Admin\AppData\Roaming\RMS-Agent\68001\E6178AFFB3\rfusclient.exe /tray /user
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\EULA.rtf

Filesize
114KB

MD5
c3d7db3461db0dbb8a1d2a937b1d6252

SHA1
35fafe6c6812f20454c709b0a43a21bf7e9f66bf

SHA256
cf8e39ce145e36d672cb2a140b3f33e0a1337975d7840e1d6a1920ce560bba46

SHA512
9759895e5d4f289e6227f65f46b24ad7f2607443bebd9b039f1cf42bd74c986a597d5de4bef70510c4463874a01695ca2f7ccbd231d6ef5316250d7492c48675

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\English.lg

Filesize
52KB

MD5
294227da6f9c610c49d38e3965bcdb71

SHA1
a6f694235a68fe35ece21d39e736e16053f4b91d

SHA256
55fb4c823838b383d077b5c45df2be5fa47abc798054701c23fde5f312379755

SHA512
0f3661ca19385d08bbee4419178f7bf9ee7701385c981b94fe81a60438f486c8bea2c048b1bdaf1387265e2d4a1ed4cec2558b7f7fa6d69916c5abbb0b7689a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\RIPCServer.dll

Filesize
150KB

MD5
59068498190113e051d94fd0b5ef98aa

SHA1
6b64bb29763c43a86a4be87fcbc94b2f4697ced3

SHA256
097c87769734699254c4f85a6268539c2d90245650930f44d245e75bcc4a3e46

SHA512
f7093d9b544fcbd3d7336b42eb9c79e17aa2b01910b3a1a23e23036d6230116e1dc3bde0602ab18efcd53c184c77d57348b2dea889c313a4a605d0714ec35ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\RWLN.dll

Filesize
966KB

MD5
56c10161ff350d143fe51affe777d19f

SHA1
54abec9bcf95904b666fa5dbdc9b976acb59e79d

SHA256
4d4dd771e72a4654063dfb06dafef1fd0701ed93c407e68b0f10782e453564c8

SHA512
229fdf7503f76ed00f05711c58d1978df9327b085c750873714a52e10db7d53bc702e800d280bb086faa3b360f0b2eecf7aa953b0f9ed1be7eabdd9793493d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\Russian.lg

Filesize
57KB

MD5
cc99020d311e97d6127ab9ddd44c980b

SHA1
57746de06ba0f206f6ef34c453b5d5cc1f00e136

SHA256
37c133f5c437a56c85ee3ca4c921f61c4532b375975c2b2dd9b4b5983e51c66b

SHA512
4122f3ef2e454382967ab3ac4e7d5f44f5156b0a97e6ebe98467d399a4281a72bc1a87f26b7f67893a64dbcb6d34e1b7775effaff969e87873b42c43eca336fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\rfusclient.exe

Filesize
5.5MB

MD5
b274f6fe4595bd970e2a14ca27c0ed51

SHA1
1829e2c4c725e363b566dd0267265dd84f3f924d

SHA256
6a285042cf70fc2087c828891d17cc33b33902943a74fec778dc88420ebd05a0

SHA512
237d524b345cff6c28bba6aec5e28d3edfc48be04277e0157ede932c857797eac1670cdb1a4979f40f19c3e6635335c944fca03f8c446570c39f5fd5ef8379de

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\rutserv.exe

Filesize
9.5MB

MD5
d10dae1197db0b694c832ae512b34024

SHA1
24757c07c814d53ded645547bc53e29c98919077

SHA256
74892811c87f574aea6d8b3a5419845a58096deaece96a9c6f06e5ad4f8859be

SHA512
f968b9084c51aa3b4f24cf99ee0d354f323d435ad7c15a884bf16dc3b8d67f721d4c7bb5f111a44033a15d820f58e813e0dccbf1f84bd3ca736a0c57bd98395e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\vp8decoder.dll

Filesize
380KB

MD5
1ea62293ac757a0c2b64e632f30db636

SHA1
8c8ac6f8f28f432a514c3a43ea50c90daf66bfba

SHA256
970cb3e00fa68daec266cd0aa6149d3604cb696853772f20ad67555a2114d5df

SHA512
857872a260cd590bd533b5d72e6e830bb0e4e037cb6749bb7d6e1239297f21606cdbe4a0fb1492cdead6f46c88dd9eb6fab5c6e17029f7df5231cefc21fa35ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\vp8encoder.dll

Filesize
1.6MB

MD5
89770647609ac26c1bbd9cf6ed50954e

SHA1
349eed120070bab7e96272697b39e786423ac1d3

SHA256
7b4fc8e104914cdd6a7bf3f05c0d7197cfcd30a741cc0856155f2c74e62005a4

SHA512
a98688f1c80ca79ee8d15d680a61420ffb49f55607fa25711925735d0e8dbc21f3b13d470f22e0829c72a66a798eee163411b2f078113ad8153eed98ef37a2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\webmmux.dll

Filesize
260KB

MD5
d29f7070ee379544aeb19913621c88e6

SHA1
499dcdb39862fd8ff5cbc4b13da9c465bfd5f4be

SHA256
654f43108fbd56bd2a3c5a3a74a2ff3f19ea9e670613b92a624e86747a496caf

SHA512
4ead1c8e0d33f2a6c35163c42e8f0630954de67e63bcadca003691635ccf8bfe709363ec88edb387b956535fdb476bc0b5773ede5b19cacf4858fb50072bbef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\webmvorbisdecoder.dll

Filesize
365KB

MD5
7a9eeac3ceaf7f95f44eb5c57b4db2e3

SHA1
be1048c254aa3114358f76d08c55667c4bf2d382

SHA256
b497d07ed995b16d1146209158d3b90d85c47a643fbf25a5158b26d75c478c88

SHA512
b68fa132c3588637d62a1c2bce8f8acc78e6e2f904a53644d732dc0f4e4fbc61a2829a1ac8f6b97fe4be4f3613ef92c43e6f2ab29c6abd968acc5acd635c990d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{72EC7F16-189E-4957-803C-263B4696AB56}\webmvorbisencoder.dll

Filesize
860KB

MD5
5308b9945e348fbe3a480be06885434c

SHA1
5c3cb39686cca3e9586e4b405fc8e1853caaf8ff

SHA256
9dc30fb2118aad48f6a5e0a82504f365fe40abb3134f6cceeb65859f61ad939a

SHA512
4d7f08dc738a944bcee9b013b13d595e9c913b248c42a6c095cbdfc6059da7f04cca935841ff8a43687b75bdc5af05e888241e52ef594aa752ba9425cf966412

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c1f29aaf98fb86737b8b1fb8084de8

SHA1
dd94ba045835112258551534ea9f003ce2786ea7

SHA256
5692bcee0e43f9a5c74a9df0c81a0939d2f75350797c34866a29d40bde028404

SHA512
0442e4d7dfd8bd56e209f8c7ffbe009adc905cc1579c14f3110c4e0095956779ef2c417509574d221b0c8c46c462f2ceaa8b5196387f2478889b947e375f98c6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf9790b86ea708cdcd6741d85b537e0a

SHA1
7fa0459dce7f8522be172c88fd838396554fb0d6

SHA256
7eb2e3d0e27f5e42aaa60eb4b89d1a3bbe582c3b3699605047732c89b9698d6f

SHA512
11ae574b95d1c84e3f44e8ba6dc1d773b6a691d41928b327c30ee62916c655dc27a04de4c4dc90eeab45e6768df71e0187409030fc2c5b95c7a95b341940b2dd

Download Submit
C:\Windows\Temp\TarB8AA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/880-208-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-223-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-238-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-233-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-228-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-220-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-218-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-215-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/880-211-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/1472-91-0x0000000000400000-0x0000000000E29000-memory.dmp

Filesize
10.2MB

Download
memory/1592-89-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2704-212-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2704-209-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2776-62-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2776-82-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2904-0-0x0000000000400000-0x0000000000EC5000-memory.dmp

Filesize
10.8MB

Download
memory/2904-83-0x0000000000400000-0x0000000000EC5000-memory.dmp

Filesize
10.8MB

Download