rms | 4ed1992d19312d2ad9a77f3b4953295f72a1711b8ae397b2f28bbb30f9c5a705

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe
Size

11.1MB
MD5

e4941baa85eb625dc69f284160390a1e
SHA1

97ce361df1c0b4c7208c817fe928b7a52e3a426b
SHA256

4ed1992d19312d2ad9a77f3b4953295f72a1711b8ae397b2f28bbb30f9c5a705
SHA512

d2fafe4b39fa3e5d56f5de9adef3ddc16fd4dd9102849114b1a9e4df7c51005b90b3ad7e49d3e8687f78b40b068f8b7ea260e0dd51019f5c4dffa31cabd5d48b
SSDEEP

196608:54dxbzckcszEJrVnw/RmU8VCOVnUB52BL+4vsN4G8uAhc4/fH5BXysTfMJq:Wn3ckFEJrK/RmU8VCOVUl4vkU/Xv3

Score

10^/10

rms defense_evasion discovery privilege_escalation rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
C:\temp\GUIPropView.exe	Nirsoft

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exeWScript.exequinto.exerfusclient.exerutserv.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	quinto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 24 IoCs

Processes:

rfuclient.exequinto.exeGUIPropView.exeGUIPropView.exerfusclient.exeGUIPropView.exerutserv.exeGUIPropView.exerutserv.exeGUIPropView.exerfusclient.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exe

pid	process
572	rfuclient.exe
100	quinto.exe
1180	GUIPropView.exe
2248	GUIPropView.exe
3004	rfusclient.exe
4732	GUIPropView.exe
3108	rutserv.exe
2816	GUIPropView.exe
4176	rutserv.exe
3084	GUIPropView.exe
5004	rfusclient.exe
4372	GUIPropView.exe
1404	GUIPropView.exe
3856	GUIPropView.exe
3208	GUIPropView.exe
3868	GUIPropView.exe
1720	GUIPropView.exe
4844	GUIPropView.exe
4228	GUIPropView.exe
4512	GUIPropView.exe
3536	GUIPropView.exe
4224	GUIPropView.exe
3456	GUIPropView.exe
2420	GUIPropView.exe

Loads dropped DLL 4 IoCs

Processes:

rutserv.exerutserv.exe

pid process

3108 rutserv.exe
3108 rutserv.exe
4176 rutserv.exe
4176 rutserv.exe

pid	process
3108	rutserv.exe
3108	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\temp\quinto.exe	upx
behavioral2/memory/100-23-0x0000000000400000-0x0000000001C41000-memory.dmp	upx
behavioral2/memory/100-204-0x0000000000400000-0x0000000001C41000-memory.dmp	upx

Drops file in System32 directory 8 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_BDC92AC5EF2F5AEC292F01D60DDFDA90	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_BDC92AC5EF2F5AEC292F01D60DDFDA90	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
defense_evasion privilege_escalation

Create Process with Token
T1134.002

Processes:

cmd.exe

pid process

4016 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

GUIPropView.exeGUIPropView.exetimeout.exetimeout.exerfusclient.exetimeout.exeGUIPropView.exetimeout.exeGUIPropView.exerutserv.exeGUIPropView.exetimeout.exeWScript.exetimeout.exeGUIPropView.execmd.exetimeout.exetimeout.exetimeout.exeGUIPropView.exeGUIPropView.exerutserv.exeGUIPropView.exetimeout.exetimeout.exetimeout.exee4941baa85eb625dc69f284160390a1e_JaffaCakes118.exePING.EXEtimeout.exetimeout.exetimeout.exeGUIPropView.exequinto.exeGUIPropView.exeGUIPropView.execmd.exeGUIPropView.exetimeout.exetimeout.exerfusclient.exeGUIPropView.exetimeout.exetimeout.exeGUIPropView.exeGUIPropView.exetimeout.exeGUIPropView.exetimeout.exeGUIPropView.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quinto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUIPropView.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3432 PING.EXE

pid	process
3432	PING.EXE

Delays execution with timeout.exe 21 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
1564	timeout.exe
4436	timeout.exe
3552	timeout.exe
4256	timeout.exe
3020	timeout.exe
1664	timeout.exe
3088	timeout.exe
4744	timeout.exe
4176	timeout.exe
2404	timeout.exe
1468	timeout.exe
3648	timeout.exe
3948	timeout.exe
3084	timeout.exe
1100	timeout.exe
3708	timeout.exe
640	timeout.exe
2136	timeout.exe
4492	timeout.exe
1792	timeout.exe
916	timeout.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe

Modifies registry class 1 IoCs

Processes:

e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

rutserv.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rutserv.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3432 PING.EXE

pid	process
3432	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rfuclient.exeGUIPropView.exeGUIPropView.exeGUIPropView.exerutserv.exeGUIPropView.exerutserv.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exe

pid	process
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
1180	GUIPropView.exe
1180	GUIPropView.exe
572	rfuclient.exe
2248	GUIPropView.exe
2248	GUIPropView.exe
572	rfuclient.exe
572	rfuclient.exe
4732	GUIPropView.exe
4732	GUIPropView.exe
572	rfuclient.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
2816	GUIPropView.exe
2816	GUIPropView.exe
572	rfuclient.exe
4176	rutserv.exe
4176	rutserv.exe
572	rfuclient.exe
4176	rutserv.exe
4176	rutserv.exe
3084	GUIPropView.exe
3084	GUIPropView.exe
4176	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe
572	rfuclient.exe
4372	GUIPropView.exe
4372	GUIPropView.exe
572	rfuclient.exe
572	rfuclient.exe
1404	GUIPropView.exe
1404	GUIPropView.exe
572	rfuclient.exe
3856	GUIPropView.exe
3856	GUIPropView.exe
572	rfuclient.exe
3208	GUIPropView.exe
3208	GUIPropView.exe
572	rfuclient.exe
3868	GUIPropView.exe
3868	GUIPropView.exe
572	rfuclient.exe
1720	GUIPropView.exe
1720	GUIPropView.exe
572	rfuclient.exe
4844	GUIPropView.exe
4844	GUIPropView.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

rfuclient.exeGUIPropView.exeGUIPropView.exeGUIPropView.exerutserv.exeGUIPropView.exeGUIPropView.exerutserv.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exeGUIPropView.exe

description	pid	process
Token: SeDebugPrivilege	572	rfuclient.exe
Token: SeDebugPrivilege	1180	GUIPropView.exe
Token: SeDebugPrivilege	2248	GUIPropView.exe
Token: SeDebugPrivilege	4732	GUIPropView.exe
Token: SeDebugPrivilege	3108	rutserv.exe
Token: SeDebugPrivilege	2816	GUIPropView.exe
Token: SeDebugPrivilege	3084	GUIPropView.exe
Token: SeTakeOwnershipPrivilege	4176	rutserv.exe
Token: SeTcbPrivilege	4176	rutserv.exe
Token: SeTcbPrivilege	4176	rutserv.exe
Token: SeDebugPrivilege	4372	GUIPropView.exe
Token: SeDebugPrivilege	1404	GUIPropView.exe
Token: SeDebugPrivilege	3856	GUIPropView.exe
Token: SeDebugPrivilege	3208	GUIPropView.exe
Token: SeDebugPrivilege	3868	GUIPropView.exe
Token: SeDebugPrivilege	1720	GUIPropView.exe
Token: SeDebugPrivilege	4844	GUIPropView.exe
Token: SeDebugPrivilege	4228	GUIPropView.exe
Token: SeDebugPrivilege	4512	GUIPropView.exe
Token: SeDebugPrivilege	3536	GUIPropView.exe
Token: SeDebugPrivilege	4224	GUIPropView.exe
Token: SeDebugPrivilege	3456	GUIPropView.exe
Token: SeDebugPrivilege	2420	GUIPropView.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

rfuclient.exerfusclient.exe

pid	process
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
5004	rfusclient.exe
5004	rfusclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
5004	rfusclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe
572	rfuclient.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

rfusclient.exerfuclient.exe

pid process

5004 rfusclient.exe
5004 rfusclient.exe
5004 rfusclient.exe
572 rfuclient.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

rutserv.exerutserv.exe

pid process

3108 rutserv.exe
3108 rutserv.exe
3108 rutserv.exe
3108 rutserv.exe
4176 rutserv.exe
4176 rutserv.exe
4176 rutserv.exe
4176 rutserv.exe

pid	process
5004	rfusclient.exe
5004	rfusclient.exe
5004	rfusclient.exe
572	rfuclient.exe

pid	process
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
3108	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe
4176	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exeWScript.execmd.execmd.exequinto.exerfusclient.exe

description	pid	process	target process
PID 5012 wrote to memory of 5060	5012	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe	WScript.exe
PID 5012 wrote to memory of 5060	5012	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe	WScript.exe
PID 5012 wrote to memory of 5060	5012	e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe	WScript.exe
PID 5060 wrote to memory of 4856	5060	WScript.exe	cmd.exe
PID 5060 wrote to memory of 4856	5060	WScript.exe	cmd.exe
PID 5060 wrote to memory of 4856	5060	WScript.exe	cmd.exe
PID 4856 wrote to memory of 1564	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 1564	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 1564	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3432	4856	cmd.exe	PING.EXE
PID 4856 wrote to memory of 3432	4856	cmd.exe	PING.EXE
PID 4856 wrote to memory of 3432	4856	cmd.exe	PING.EXE
PID 4856 wrote to memory of 4436	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4436	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4436	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 572	4856	cmd.exe	rfuclient.exe
PID 4856 wrote to memory of 572	4856	cmd.exe	rfuclient.exe
PID 4856 wrote to memory of 4176	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4176	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4176	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4016	4856	cmd.exe	cmd.exe
PID 4856 wrote to memory of 4016	4856	cmd.exe	cmd.exe
PID 4856 wrote to memory of 4016	4856	cmd.exe	cmd.exe
PID 4016 wrote to memory of 100	4016	cmd.exe	quinto.exe
PID 4016 wrote to memory of 100	4016	cmd.exe	quinto.exe
PID 4016 wrote to memory of 100	4016	cmd.exe	quinto.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 1180	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 1180	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 1180	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 4492	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4492	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4492	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 2248	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 2248	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 2248	4856	cmd.exe	GUIPropView.exe
PID 100 wrote to memory of 3004	100	quinto.exe	rfusclient.exe
PID 100 wrote to memory of 3004	100	quinto.exe	rfusclient.exe
PID 100 wrote to memory of 3004	100	quinto.exe	rfusclient.exe
PID 4856 wrote to memory of 2404	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 2404	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 2404	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 4732	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 4732	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 4732	4856	cmd.exe	GUIPropView.exe
PID 3004 wrote to memory of 3108	3004	rfusclient.exe	rutserv.exe
PID 3004 wrote to memory of 3108	3004	rfusclient.exe	rutserv.exe
PID 3004 wrote to memory of 3108	3004	rfusclient.exe	rutserv.exe
PID 4856 wrote to memory of 1468	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 1468	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 1468	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 2816	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 2816	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 2816	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 3648	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3648	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3648	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 3084	4856	cmd.exe	GUIPropView.exe
PID 4856 wrote to memory of 3948	4856	cmd.exe	timeout.exe
PID 4856 wrote to memory of 3948	4856	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4941baa85eb625dc69f284160390a1e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\temp\HideVai.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\temp\vai.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1564
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 www.google.com
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3432
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 30
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4436
  - - \??\c:\temp\rfuclient.exe
      "c:\temp\rfuclient.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:572
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4176
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" "c:\temp\quinto.exe""
      4⤵
      Access Token Manipulation: Create Process with Token
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4016
    - - \??\c:\temp\quinto.exe
        
        "c:\temp\quinto.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:100
      - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rfusclient.exe" -run_agent
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rutserv.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rutserv.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rutserv.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rutserv.exe" -second
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4176
        
        C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rfusclient.exe" /tray /user
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5004
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3084
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4492
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2404
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1468
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2816
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3648
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3084
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3948
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1100
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1404
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3552
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3856
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3708
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1792
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3868
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:640
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1720
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4256
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4844
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3020
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4228
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2136
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1664
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:916
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3088
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3456
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT /T 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4744
  - - \??\c:\temp\GUIPropView.exe
      GUIPropView /Action Hide Title:"COMUNITA MONTANE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Arabic.lg

Filesize
55KB

MD5
f6ea3881bd23cb0ee957993fee23c6b4

SHA1
fdd6e4cc3ed79e7ee06a6bb5095cbf2904684e81

SHA256
e6f350f2cb7dd59c3806b346af9be54f490641d06e573b3ea7ddf7ce5c529078

SHA512
a34840f3e4543228891f086d4416d3da538e7a9ee6182843bffe4bd0522c8090e2f87a5bdae194c8e3cf0cf0e8cef004ea39c0685b25012ea406868dce0d61b0

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Chinese Simplified.lg

Filesize
41KB

MD5
6d995e848c199a5c0c4128a28b07affe

SHA1
6de6724ba2b5ddb85c86abe353b421786daf89f1

SHA256
09db4c31bede5f3a1000f32158c6f71f0380fcb73941e6826f4a3f5a36e868ff

SHA512
d85a56df1729abff7cee06d42ae524432af3cbfe60fb841d198a9da896443ec342a06eea8fae06912378ec64551897d4eba3df4b086fb46272df90d26d80f5d9

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Chinese Traditional.lg

Filesize
41KB

MD5
0ed6a1984e883d26c3f04b7701ffa436

SHA1
b06c8b34e7ed3f1cbec177da7c669c074c89a1f9

SHA256
fafcd673fdaec9eb1631849d68cb08d807a340279eb0221b544ead71f5b2dc69

SHA512
01326032709cee18b681c169c686a035293f80835500e46e277a5897ce8474ca937597a7a15323bb75dddce3bfafae4c4f9b872154f54779ecd7cd464cc4d06f

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Czech.lg

Filesize
59KB

MD5
8b0bfc75787bae7f7dc55e720e1a1472

SHA1
63c8d42de2526551fb8fd9f31f30e52ee92a13a2

SHA256
81a15eae890f2051fea1f04c031dedba11b2b7cfc04a81223b1adac895033a0f

SHA512
f348dee9e9c7e62556a0c111d1fa019120375f099f5d593144765be57fd196b05d6d3e06359cc15e7b181d0cb457b7d623892af5da915108e7a71cd29a08f956

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Danish.lg

Filesize
59KB

MD5
f621aa5d8a4d8bb667e73e1c05d6fe18

SHA1
2319c0afdbcd5d0c208581c05056b145e5d910d0

SHA256
cbde3517ad89a72dbcb7a693be55cbc07f5d46e88bb28128624e21d400c02408

SHA512
adc6ae4bb16c21f46a830d73d084a5ac7509aede6e86dbd1d424048d5ed431d3eb6f2158f627981ca432735c62f79f8023e3798c1f0e112f3ad8e67ef596d596

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Dutch.lg

Filesize
61KB

MD5
7c8f08d575e4a7cfa11a4ad6ddbe58ba

SHA1
902a838ff647321ca5405dd95ef8e2374b0b4388

SHA256
d4f47f4bf74574243afcf501eab3d4e9d0d5f7a624ac1139afd5db90615d9f9f

SHA512
a020f88914628847d5e61c9999ee26fd01fafd5e87388130848d67be04d8a3603e64fd42320684196459510fa55c85a30d175538e1a24153be407271237b827a

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\EULA.rtf

Filesize
70KB

MD5
79f2c0330971c5e1d54c8563524095d0

SHA1
c6aae9892f145d4dec64d85797d4acebc60907c1

SHA256
7e7d597254aaa6533c42cbb30593240ba00c71f3638b2ea15b681c76e979b6e8

SHA512
830de86fc44d3f5881e5b22d67470e8134baffe115d8187452569b348cb059ca82880339e169287c25897f558419fcaa99fee9fc033d13e0838d9bc921de0504

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\English.lg

Filesize
59KB

MD5
9a1fdea3797f3f8ee8f14bd2e053aff7

SHA1
504ee198497352126e8256208d383c443cdf980a

SHA256
dbfea93714fea4e7880aba1093f84975dc8b06f8b9c09e742b4a8565a638a4df

SHA512
a7a7e7027431c2153a614e0d96552080dac53315fff793ae8b37dcf24e16500d62e761ac9384c45ef081fc573084fa9a93e11222e6dd162b33051e84cb142c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\French.lg

Filesize
63KB

MD5
2849bda8e859811129f91ef911a8c34c

SHA1
6d01aed37e3fe26b9c4bc2eedc5ca9e2b116649f

SHA256
520968397ed6f5c0eab760dc33b0c0d8a13381f66d240810cfe58f07a6ee5cb5

SHA512
f7568d9e79ccfa6231b066cef3f6ca8e8dea56ac9286662000dcccd5de0026b3637482e4222b4212a911d87c244377c265b139bead685d0ddf1b86dad40a1b13

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\German.lg

Filesize
61KB

MD5
e3e6c94329a75d7197d283976d50ed29

SHA1
6a2c3ca6f6db2f5c1da2c454eb88a192cace4090

SHA256
23e1a930e42edd46efbf49bae2cb6562e3da6e2b553b39cc2aee62ac24cdc844

SHA512
fc07fd8985764c74c02b79053bc48ac5f19ecd240b17ef5297c9d6ce677981bacef39a0b9fcb9b9ef9832eb8d2ab6638e35c2428b14d41101732c3c27e4e1d38

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Hebrew.lg

Filesize
52KB

MD5
00e28c3cd7737b444cd9fbde21bd4164

SHA1
0d80ced7c9818d07c29508538e463f7a36ccef33

SHA256
a7e5178ebb640a20d9f3691b5c1bf13ef08d4d5d1ddc2322bda0bc99ec18dc0e

SHA512
be6f06c1f2a52c7aa615cd3faf07f5b79db3a94d28e82e20598cfec5cb704b7db12448d2fdfc1c2716faa84379fd690f59a22d3ae9ca139f291e5d24007a8ab3

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Italian.lg

Filesize
61KB

MD5
9f2fb43c9393cef888ca546138db3391

SHA1
24a499e0109f07ab57f8e8de02621de6519ddea0

SHA256
ba6d0413ceb84bc4e9a677472fe8f18599e3ab83c81c45179109f27d8b2d99aa

SHA512
c523f0053128dceae4893151c93cd5c3d00554bab3ff00829e5b91b83edc0ebbd2f7439368a8387873c7d3e35f22ec682c44eb22f6c2fb08e6b534086c8d54b4

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Japanese.lg

Filesize
47KB

MD5
7683e967f436194a77c6c1fdd1b59b0f

SHA1
9eab3d831de2f6b970c144b88ead1bd720333db1

SHA256
9e9bcecba94dcf8ce3ff9de9d0ffa77dddc37ff0f4b910761c9cd506c2e1030b

SHA512
4e896d3d9368fdd8619eebd9d36405942b1441cf02d3f907ea3fb7641fe2ca11bf68782e2e72d19f498e5ec3ae5748435b1028bfbd9fc25161dc5e21b85f8e14

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Korean.lg

Filesize
45KB

MD5
915f8dbc7448f3bfb8354589ad2fc3cb

SHA1
8dc225137ba636edd312ad7b1b5397ff128adf41

SHA256
692899e2cf25e6c8c358d3d3a63662970cb1aa7e63aac2cdee8ab1efcc6dbc55

SHA512
aa3963655bc08c20efcb75a005f9c3d45e20785e13e803f59a25194f6656e3965e47e0ee6c68bda7ffb51be30676b4b5be7d388379a6d75c8fd0125eb512ef52

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Norwegian.lg

Filesize
58KB

MD5
8b9a680cd0e581c35624f870f083b2da

SHA1
c37417a00c0dedee94c57f6dc05a2c7f755ec600

SHA256
1f8dc472a0105547f913a84c34192b078fdf0ca6da2e9a3125e3770090de6b49

SHA512
b5f93428cfcfd3882b54c666df2ef695fa4e3baecb677bfdddc20a8c28fc635f1249e581e0f75069a49e64426825acab63124c009ce78407b01157730f85c983

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Polish.lg

Filesize
59KB

MD5
baaefbe6e3758c5b8d79fc5513b9f63a

SHA1
c35716d506fe5b6bac4bd45d7e7be104c00a6833

SHA256
2e3f5398fcf716600c72258de408392d3cee5901ccf30885042a3c2d3d3d9c74

SHA512
df2bb8cf9972266ef5280d2e4beec5e122914c48f266442070a5cfb898610b6fb0f417941961d742269c243315662ae181981525bbb04aebabc583dd0f5d44dd

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Portuguese, Brazilian.lg

Filesize
61KB

MD5
c3778e1dcb95065f7c2cba53d490d6b8

SHA1
bf08a8a0eb47dcc5e848e955daa112c82c4519a5

SHA256
38af7f5d7233b51adcbeca92ab28b146302ea6ad61bcfa4cdc765c2b60759f04

SHA512
1edefb2cb065f836e4767e02b70c0a9ea080ba9b7a7f938b805be221eb516dbdb20e601aa28131517bf8125dd8966d55ec3a164d2be2a1f38e4b2fedffd17a6f

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Portuguese.lg

Filesize
61KB

MD5
10f4324b24a9bd1b6c04cfc60f3f6405

SHA1
4e4c0fd79fec57a03211ee46028f7b0dd6a2978c

SHA256
57a6b2490e64471a555015f5f32b544833aacd0cd53cb67e65d7081fee644d73

SHA512
f7285f68baef6b987bb7c99c4221a26be488274750f8eccab12b4049ee07be9d8d7d0c7abb24bc6e42efa50697213be7e4350e964fe3281687a548c2690d924d

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Spanish.lg

Filesize
61KB

MD5
c9f142a80f4552867e8c87b680e90ba7

SHA1
072df48fc1d5ed50db04f4bec9c4a3ed32d8db37

SHA256
5c242b2a08d7ea452c6468c11e2b7a0882fb45caafa608e5e8c7661819539ec2

SHA512
fe0671aa76c0682e95683a3b4482e1a63a894bdfe9a4a6735ae463e2c30df861377f67e48699859fe7c50d5cb7ed88ec4fd2f6622ac2d2b126550a8696765ab3

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Swedish.lg

Filesize
58KB

MD5
01583be353cff2a0b67803f4a43f394d

SHA1
7a924df31d9720a0bc5a40a501daa11ad83675a7

SHA256
01b1a41beb45a4b31657ae347c6958527fe23866274e6432a027fd888c9df57d

SHA512
4c715cbfe804afc1802981506b58ac714668d8afc9f7b9be4c8869f7300a0281090b21fcb4ffe6efc455d3a42da37d866139490fd604c2318ab46b02b3722d2f

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\Turkish.lg

Filesize
59KB

MD5
5c8be08e6573e844677c918f843fc58d

SHA1
29959ebd91532107c8d4524238b3bb54d927e2c6

SHA256
309003bd06b36380a7f53d92f2e8a3083cce6c01ed9b773a558ed2298d4a45a4

SHA512
13affbf0d90b85043475d28f4346d8f4fd21ab2f1c64b8ee56a96e817786cfca7c42b46a7b1c11364e2ffd4148337dcb1cd108215055637ae78c2b27018f8ba0

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\branding.ini

Filesize
350B

MD5
ca8aa2272184fae7f24ebb483173074f

SHA1
96bab1084336c47c99a7181f67ca150bcdf264f9

SHA256
161725c6429f76f92dee0fa89bae52a736a35b9f5dba45ed01f448ba44582339

SHA512
ce31b87aedacd683b550bca60544d0e9113e11b42489a59417121b09701e4ae207ee049e13350c6c58ce1d8151b1eb508390875832a5cabe943156c246b9096d

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\libeay32.dll

Filesize
1.3MB

MD5
146dfe563aeab6edb51eb24c37494251

SHA1
f54a31a9211f4a7506fdecb5121e79e7cdc1022e

SHA256
23b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d

SHA512
7df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\logo.png

Filesize
153KB

MD5
979f26eb9a9ea8288d3620587f8ddbd8

SHA1
34f17e5cf1ca1eb1af84b7066620df486a6f9f0b

SHA256
ca5105dbb6825d0e534c6b66fb421d6ab4c615c9741cfea32fe56a3bed5a3fbb

SHA512
0539d91aab8c2a018bd642bec25c39a01fe34fb96047e51039395db363a20a1b6742b7aa6b544d34fe7e0cb6fd0031613217eae95a6277745dc0331f3f592e4c

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rfusclient.exe

Filesize
6.3MB

MD5
b308291b116f14939f59b9b63b98f007

SHA1
bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf

SHA256
d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80

SHA512
f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\rutserv.exe

Filesize
12.6MB

MD5
364ec0894d60d3cdd917561626084c5a

SHA1
71262de7339ca2c50477f76fcb208f476711c802

SHA256
322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c

SHA512
37fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\settings.dat

Filesize
8KB

MD5
b6897b3d9c4540c17de524dfaeecfed6

SHA1
50b256723a8cf1c4e80161250f6b578b67335485

SHA256
b08adb43a6be6a1f7fdf74fcd80d117cd835f47169d6447b03d8428015ebaf6c

SHA512
4c1d5952a6440aa0215bcc06bcca90c941d939416bfeee76f6b996be47365195356cf9b51773ff41b8a1bf408364684619fdbc5a96a260888d6b4e0ffd569c30

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\ssleay32.dll

Filesize
337KB

MD5
7450078342329c700f7fef4f84c11cde

SHA1
18ee67c1a9e7b9b82e69040f81b61db9155151ab

SHA256
9f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67

SHA512
07c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\vp8decoder.dll

Filesize
380KB

MD5
b734c92aece61a0471984b1fafb2db03

SHA1
17e5ef96d462ebc79e75472dc376ec7b65bfc5ef

SHA256
78b2a0c2b220875d1111efcca49839f56af89ac7d17ab9f4dbbb2af817440a31

SHA512
dd51116862a0434a7300c9532c03bfd07f04582da5d801e45ec41619555ecd0985fd521792cbe3f8ce47e087ed40c3ca2f1c8db0dda0ff0529c81e6452708aec

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\vp8encoder.dll

Filesize
1.6MB

MD5
afdab890be73c9945d6e96dfafd0c997

SHA1
60e2b20c2ae650d664a820c9b9d799619ef97456

SHA256
ced7a854946fb1a2ce6491c94acba9697d3b360ba4efd0e9e6450802d601c57a

SHA512
8438aae312f344ac09906d9d01e9bb18835f970921e9a58ddec8cd6a20a7ea41820376cf7eee6c8e0068ef2089ff6d6c4bc875fe44331283c91bb5b95a1ea6e1

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\webmmux.dll

Filesize
260KB

MD5
50784c57f4d034b33150b8dbe9b029ca

SHA1
c393732f929851da135b71cf0b8d065f31a15dd9

SHA256
b287fa75d93e08cad6fe680196a94a3693f9d4f3328e0066b82ca8088472055a

SHA512
feb98808143caa1ab88187d96056ea1011f882799f608e3f59492d34eae1002f258fbbce99171a715545fffb3e2f2fc6a9c1a631f639d474eb074446f3ac7bd7

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\webmvorbisdecoder.dll

Filesize
365KB

MD5
c7b616d2ad36ed68aef3621b45cd0831

SHA1
ea2da553244d43a60b9ddbedaeb02dcf7185ac5d

SHA256
e609d5253483bafe10baa880a33968c98620ad753a557ef38c2ed4694a118585

SHA512
9bdb3e76fa1533c862226438ba78a9112f41d7b431b8885bebf33ca170190f31cc4d05db641ec02728f08815fac4c1b73c98b04e26ce857bf298cee3ec05b408

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\69110\83E315F36F\webmvorbisencoder.dll

Filesize
860KB

MD5
ff70441f6fd3eeb5a061c117a13da554

SHA1
d8ca8841e636436c4d4c7ef0479c549b404a9983

SHA256
4f8ef46af1591a5906dba229be6866d756f29778d562b503b30d967b1a75339d

SHA512
c54d82d34b5e52097096357471156b8ad4f579b9b679b513fa063c25becc6cb0c54023f2ae5ec61a3a19a5d6b262a961ab3df970e431467488ad3196fd2c2882

Download Submit
C:\temp\GUIPropView.exe

Filesize
108KB

MD5
7f6bdda297cb34283ae0c53de4e56459

SHA1
d03565bbeb3494971b2f5b8ff04c238dbfa58f92

SHA256
2e94f3e1f25f9ff5ea0cfb1a735e5e50390f7d42a3f5369fb0c7f68114185e08

SHA512
35f0ca4326e5fdcef5f8eff759089225a4adc92eb8076c354c14153b15edf2c7714cbcfcbd12c9eac4e70e04829c73e8c31b3993a9e82e163842fe9872892ae8

Download Submit
C:\temp\HideVai.vbs

Filesize
85B

MD5
8442c7beff244dac056ccb9f81dfa5ce

SHA1
8ff59e73ad775ceeb52d61de787bc3cfec23e4a9

SHA256
dfc6cf3f9160fde97de841bfc179e1a2ae9358b7db7e0a86c3b231ce91a8a83d

SHA512
8e5c50110c953e6a71cb3793d7e71e743e427d00f7ca24fd80407948aa947c2a709d6e3d4ac3233cd2263234f81d568cfd53dfcdf26803a0f37465681aaf72b3

Download Submit
C:\temp\quinto.exe

Filesize
11.2MB

MD5
fb9d1308bf2d8b215a255efa28a3bf65

SHA1
333f6aee99a66803375babb23e1a0cbc7f069fb8

SHA256
7f3962fd46ec4af3df561bc241f8497b0959bf66d73db5dbe2299a654797c513

SHA512
0d11e430fb1174b98a25ec6499c8cbc860bb3ee6ccd639b683e223e19dc218154507c3096191e8a372c55b61c127f35c8efb0a15157b80be726b07f791d773c0

Download Submit
C:\temp\rfuclient.exe

Filesize
18KB

MD5
b3ad0c36d6123dd8d9dba23d134baa6d

SHA1
df1d3690e820c5a3431b6001d9198445a05f87f7

SHA256
3b89a2d993481d960fe55891a56054e6032841d970d85dc47864f090e9221f4c

SHA512
82915bc9adb33912df75f18f8b245145ca24a35ac5dd98f0b7cfc05848fa56c35ad876a557b8687d9419dc5a7fe177fcde527b9993e52d0c5627870f5f79aa42

Download Submit
C:\temp\vai.bat

Filesize
1KB

MD5
72fb6c45e0d1b4a89ce13f51538a76d8

SHA1
9fe7eaeac786baec04f7f8e3128a5aa1cd9baa9f

SHA256
3cd5276c9e2d671b4c97e94bf10a39e6a8700ff8bf22b6f7d5ce8b8e12e96a5c

SHA512
06ec258a1dc67dba6fb976790972e8c2c3def038bc17fc531c050893335ef44bdaaf90dd5fd0d69fe4199e0f181ee19a6929e95beb8d92509c3f7995a150d685

Download Submit
memory/100-23-0x0000000000400000-0x0000000001C41000-memory.dmp

Filesize
24.3MB

Download
memory/100-204-0x0000000000400000-0x0000000001C41000-memory.dmp

Filesize
24.3MB

Download
memory/572-19-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/3004-209-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/3108-217-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-279-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-310-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-292-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-321-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-296-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-316-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-300-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-313-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/4176-303-0x0000000000400000-0x0000000001133000-memory.dmp

Filesize
13.2MB

Download
memory/5004-298-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-304-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-301-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-314-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-284-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-317-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-293-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download
memory/5004-322-0x0000000000400000-0x0000000000AE2000-memory.dmp

Filesize
6.9MB

Download