File name:

4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc

Full analysis: https://app.any.run/tasks/a93f021d-fbc2-4230-943f-d5489faacf7a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 28, 2025, 11:53:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remote
rms
rat
neshta
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

52081F96292FF72FE4F99FF18E511E43

SHA1:

0A4078ABAE51623BA3E05F32E7131C161B537386

SHA256:

4C80796C4C8511A14E81FD2AC28275D67228AA964F9D5808F16CBABAA76DC8BC

SSDEEP:

98304:gIg2CL9mIKJUt+/793K8/fVVNpXAKLcUeCPu7Oz7XyqgLQzg0jhc/7eZrBRoCgkE:dUN8O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NESHTA mutex has been found

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • Drop RMS (RAT) executable file

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 5596)
      • net.exe (PID: 7020)
      • net.exe (PID: 7148)

    • Executing a file with an untrusted certificate

      • rutserv.exe (PID: 2088)
      • rutserv.exe (PID: 6564)
      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • FileCoAuth.exe (PID: 7768)

    • RMS is detected

      • regedit.exe (PID: 6644)
      • rutserv.exe (PID: 5404)

    • RMS mutex has been found

      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • rutserv.exe (PID: 5404)

    • RMS has been detected (YARA)

      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Mutex name with non-standard characters

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • Executable content was dropped or overwritten

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • Creates a software uninstall entry

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • The process executes VB scripts

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • wscript.exe (PID: 8056)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 8168)
      • wscript.exe (PID: 1244)
      • wscript.exe (PID: 7392)
      • wscript.exe (PID: 4776)
      • wscript.exe (PID: 5364)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 8168)
      • wscript.exe (PID: 7392)
      • wscript.exe (PID: 1244)
      • wscript.exe (PID: 4776)
      • wscript.exe (PID: 5364)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 8168)

    • Application launched itself

      • wscript.exe (PID: 8056)
      • rfusclient.exe (PID: 7152)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 8168)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 8168)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 8056)

    • Windows service management via SC.EXE

      • sc.exe (PID: 780)
      • sc.exe (PID: 864)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5596)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 5596)

    • Executes as Windows Service

      • rutserv.exe (PID: 5404)

    • Potential Corporate Privacy Violation

      • rutserv.exe (PID: 5404)

    • Connects to unusual port

      • rutserv.exe (PID: 5404)

    • There is functionality for taking screenshot (YARA)

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)

    • Process drops legitimate windows executable

      • FileCoAuth.exe (PID: 2152)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 7768)

  • INFO

    • The sample compiled with english language support

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Checks supported languages

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • rutserv.exe (PID: 6240)
      • rutserv.exe (PID: 6564)
      • rutserv.exe (PID: 5404)
      • rutserv.exe (PID: 2088)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • FileCoAuth.exe (PID: 7768)

    • Create files in a temporary directory

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 7768)

    • Process checks computer location settings

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Reads the computer name

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • rutserv.exe (PID: 2088)
      • rutserv.exe (PID: 6240)
      • rutserv.exe (PID: 6564)
      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 6044)
      • FileCoAuth.exe (PID: 7768)

    • Creates files in the program directory

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • Reads the machine GUID from the registry

      • FileCoAuth.exe (PID: 7768)

    • Creates files or folders in the user directory

      • FileCoAuth.exe (PID: 7768)

    • Compiled with Borland Delphi (YARA)

      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)
      • rutserv.exe (PID: 5404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (60.4)
.scr | Windows screen saver (18.3)
.dll | Win32 Dynamic Link Library (generic) (9.2)
.exe | Win32 Executable (generic) (6.3)
.exe | Generic Win/DOS Executable (2.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2027:10:01 16:14:52+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 29696
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x80e4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
30
Malicious processes
11
Suspicious processes
7

Behavior graph

Click at the process to see the details
start #NESHTA 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe no specs 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs attrib.exe no specs rutserv.exe no specs rutserv.exe no specs #RMS regedit.exe no specs rutserv.exe no specs #RMS rutserv.exe #RMS rfusclient.exe no specs #RMS rfusclient.exe no specs #RMS rfusclient.exe no specs filecoauth.exe no specs filecoauth.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
780sc delete netaserviceC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
864sc delete rmanserviceC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
1180C:\windows\spom\rfusclient.exe /trayC:\Windows\spom\rfusclient.exe
rutserv.exe
User:
admin
Company:
TektonIT
Integrity Level:
MEDIUM
Description:
RMS
Version:
6.3.0.2
Modules
Images
c:\windows\spom\rfusclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1244"C:\Windows\System32\wscript.exe" "C:\windows\spom\15971.vbs" RunC:\Windows\SysWOW64\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1672attrib +s +h "C:\WINDOWS\spom"C:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
1764reg delete "HKLM\SYSTEM\Remote Manipulator System" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
1912\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"rutserv.exe" /silentinstallC:\Windows\spom\rutserv.exe—cmd.exe
User:
admin
Company:
TektonIT
Integrity Level:
HIGH
Description:
RMS
Exit code:
0
Version:
6.3.0.2
Modules
Images
c:\windows\spom\rutserv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2152C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4776"C:\Windows\System32\wscript.exe" "C:\windows\spom\15971.vbs" RunC:\Windows\SysWOW64\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
7 425
Read events
7 393
Write events
31
Delete events
1

Modification events

(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayName
Value:
RMSBuilder 6.3.0.5 6.3.0.5
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayVersion
Value:
6.3.0.5
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:VersionMajor
Value:
6
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:VersionMinor
Value:
3
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:Publisher
Value:
Company UFOLABS
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\Uninstall.exe
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\Uninstall.exe
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:URLInfoAbout
Value:
Ufolabs.net
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:HelpLink
Value:
ufolabs@mail.ru
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\
Executable files
13
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\rutserv.exeexecutable
MD5:123809145089775BE00FC392376BE38F
SHA256:8186F539D911E7F8841633C6F277A4A414A23FB2F989155792FB0F004C74FAA9
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\15971.battext
MD5:8F53FA25ABBB767010AB8BB83F00032D
SHA256:87858D85CCB00011D283D88EBBFC746A901635E969E16B60A6B640517BA48E3D
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\rfusclient.exeexecutable
MD5:2736534AC3AD65379869042C9BD05C54
SHA256:C614201DCE04DAC96A73DA44F7165C75A5BA202E240AECC8D98E5C9526B906FA
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmpcompressed
MD5:8FD57DC4B37B9FFED049DF47CE23D862
SHA256:590137997DFF00469FE3B0D42C6D4BCCB6D39A363722528C30BBCA0F6994AE56
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\3582-490\4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeexecutable
MD5:F331E412E07F7B983FC0949E036CCBC3
SHA256:A3CA6BF622E07805D3C5A2C95CDB9E645C4176C552699AC160E0C38A0197A83F
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\15971.vbstext
MD5:DB28C49DE866BF2D2B94188E94BDCAF0
SHA256:0BE52B249B2B73D1A70BA8D6CFB3F20D609DAF1912109E500C5A460CB69EE55C
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\$inst\2.tmpcompressed
MD5:8708699D2C73BED30A0A08D80F96D6D7
SHA256:A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:53CC63DDB66EC5F67F1AF479E55854D4
SHA256:3D63C9216B26FE6F74274C0C646DB1F77523818AE1C0A90986E4B0BBC712576F
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:25C14B46E078DEF0AAB4D421363C8800
SHA256:089D0E4722D06CB514C511630D01BA8FD6E55A04190E53570F6B83E35EF45A4E
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncConfig.exeexecutable
MD5:DE68D91DEB7DF90857BEE6065F8BA9FC
SHA256:C817A454B440FF4E0A529FF6E3B36597EAD6A793EB6D19C9502680DA26198966
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
8
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5404
rutserv.exe
GET
200
31.31.198.18:80
http://rmansys.ru/utils/inet_id_notify.php?test=1
unknown
—
—
malicious
5404
rutserv.exe
POST
200
31.31.198.18:80
http://rmansys.ru/utils/inet_id_notify.php
unknown
—
—
malicious
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5404
rutserv.exe
31.31.198.18:80
rmansys.ru
Domain names registrar REG.RU, Ltd
RU
malicious
5404
rutserv.exe
77.223.119.187:5655
rms-server.tektonit.ru
OOO Network of data-centers Selectel
RU
suspicious
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
rmansys.ru
  • 31.31.198.18
malicious
rms-server.tektonit.ru
  • 77.223.119.187
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
5404
rutserv.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
5404
rutserv.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] Remote Access Tool Has been detected
5404
rutserv.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] Remote Access Tool Has been detected
Process
Message
rutserv.exe
TMainService.Start
rutserv.exe
GUID_CONSOLE_DISPLAY_STATE
rutserv.exe
Not allowed.
rutserv.exe
28-04-2025_11:53:48:193#T:Msg Size: 104
rutserv.exe
28-04-2025_11:53:48:193#T:Msg code: 3
rutserv.exe
MSG_KEEP_ALIVE
rutserv.exe
28-04-2025_11:53:48:193#T:MSG_KEEP_ALIVE
rutserv.exe
28-04-2025_11:54:19:849#T:Msg code: 3
rutserv.exe
28-04-2025_11:54:19:849#T:MSG_KEEP_ALIVE
rutserv.exe
28-04-2025_11:54:19:849#T:Msg Size: 104
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc