File name:

4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc

Full analysis: https://app.any.run/tasks/a93f021d-fbc2-4230-943f-d5489faacf7a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 28, 2025, 11:53:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remote
rms
rat
neshta
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

52081F96292FF72FE4F99FF18E511E43

SHA1:

0A4078ABAE51623BA3E05F32E7131C161B537386

SHA256:

4C80796C4C8511A14E81FD2AC28275D67228AA964F9D5808F16CBABAA76DC8BC

SSDEEP:

98304:gIg2CL9mIKJUt+/793K8/fVVNpXAKLcUeCPu7Oz7XyqgLQzg0jhc/7eZrBRoCgkE:dUN8O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NESHTA mutex has been found

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • Drop RMS (RAT) executable file

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • Starts NET.EXE for service management

      • net.exe (PID: 7020)
      • cmd.exe (PID: 5596)
      • net.exe (PID: 7148)

    • RMS is detected

      • regedit.exe (PID: 6644)
      • rutserv.exe (PID: 5404)

    • RMS mutex has been found

      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • rfusclient.exe (PID: 7152)

    • Executing a file with an untrusted certificate

      • rutserv.exe (PID: 6564)
      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 1180)
      • rutserv.exe (PID: 2088)
      • rfusclient.exe (PID: 6044)
      • FileCoAuth.exe (PID: 7768)

    • RMS has been detected (YARA)

      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Mutex name with non-standard characters

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 8168)
      • wscript.exe (PID: 4776)
      • wscript.exe (PID: 5364)
      • wscript.exe (PID: 1244)
      • wscript.exe (PID: 7392)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 8168)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1244)
      • wscript.exe (PID: 8168)
      • wscript.exe (PID: 8056)
      • wscript.exe (PID: 4776)
      • wscript.exe (PID: 5364)
      • wscript.exe (PID: 7392)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 8056)

    • Creates a software uninstall entry

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • Executable content was dropped or overwritten

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • FileCoAuth.exe (PID: 2152)

    • The process executes VB scripts

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • wscript.exe (PID: 8056)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 8168)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 8168)

    • Windows service management via SC.EXE

      • sc.exe (PID: 780)
      • sc.exe (PID: 864)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5596)

    • Application launched itself

      • wscript.exe (PID: 8056)
      • rfusclient.exe (PID: 7152)

    • Executes as Windows Service

      • rutserv.exe (PID: 5404)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 5596)

    • There is functionality for taking screenshot (YARA)

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)

    • Connects to unusual port

      • rutserv.exe (PID: 5404)

    • Potential Corporate Privacy Violation

      • rutserv.exe (PID: 5404)

    • Process drops legitimate windows executable

      • FileCoAuth.exe (PID: 2152)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 7768)

  • INFO

    • Create files in a temporary directory

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 7768)

    • Checks supported languages

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • rutserv.exe (PID: 6240)
      • rutserv.exe (PID: 2088)
      • rutserv.exe (PID: 5404)
      • rutserv.exe (PID: 6564)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • FileCoAuth.exe (PID: 7768)

    • The sample compiled with english language support

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Reads the computer name

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • rutserv.exe (PID: 2088)
      • rutserv.exe (PID: 6240)
      • rutserv.exe (PID: 6564)
      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 1180)
      • rfusclient.exe (PID: 6044)
      • rfusclient.exe (PID: 7152)
      • FileCoAuth.exe (PID: 7768)

    • Process checks computer location settings

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7820)
      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)
      • FileCoAuth.exe (PID: 2152)

    • Creates files in the program directory

      • 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe (PID: 7960)

    • Compiled with Borland Delphi (YARA)

      • rutserv.exe (PID: 5404)
      • rfusclient.exe (PID: 7152)
      • rfusclient.exe (PID: 1180)

    • Creates files or folders in the user directory

      • FileCoAuth.exe (PID: 7768)

    • Reads the machine GUID from the registry

      • FileCoAuth.exe (PID: 7768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (60.4)
.scr | Windows screen saver (18.3)
.dll | Win32 Dynamic Link Library (generic) (9.2)
.exe | Win32 Executable (generic) (6.3)
.exe | Generic Win/DOS Executable (2.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2027:10:01 16:14:52+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 29696
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x80e4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
30
Malicious processes
11
Suspicious processes
7

Behavior graph

Click at the process to see the details
start #NESHTA 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe no specs 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs attrib.exe no specs rutserv.exe no specs rutserv.exe no specs #RMS regedit.exe no specs rutserv.exe no specs #RMS rutserv.exe #RMS rfusclient.exe no specs #RMS rfusclient.exe no specs #RMS rfusclient.exe no specs filecoauth.exe no specs filecoauth.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
780sc delete netaserviceC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
864sc delete rmanserviceC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
1180C:\windows\spom\rfusclient.exe /trayC:\Windows\spom\rfusclient.exe
rutserv.exe
User:
admin
Company:
TektonIT
Integrity Level:
MEDIUM
Description:
RMS
Version:
6.3.0.2
Modules
Images
c:\windows\spom\rfusclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1244"C:\Windows\System32\wscript.exe" "C:\windows\spom\15971.vbs" RunC:\Windows\SysWOW64\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1672attrib +s +h "C:\WINDOWS\spom"C:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
1764reg delete "HKLM\SYSTEM\Remote Manipulator System" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
1912\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"rutserv.exe" /silentinstallC:\Windows\spom\rutserv.exe—cmd.exe
User:
admin
Company:
TektonIT
Integrity Level:
HIGH
Description:
RMS
Exit code:
0
Version:
6.3.0.2
Modules
Images
c:\windows\spom\rutserv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2152C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4776"C:\Windows\System32\wscript.exe" "C:\windows\spom\15971.vbs" RunC:\Windows\SysWOW64\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
7 425
Read events
7 393
Write events
31
Delete events
1

Modification events

(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayName
Value:
RMSBuilder 6.3.0.5 6.3.0.5
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayVersion
Value:
6.3.0.5
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:VersionMajor
Value:
6
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:VersionMinor
Value:
3
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:Publisher
Value:
Company UFOLABS
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\Uninstall.exe
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\Uninstall.exe
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:URLInfoAbout
Value:
Ufolabs.net
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:HelpLink
Value:
ufolabs@mail.ru
(PID) Process:(7960) 4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RMSBuilder 6.3.0.5 6.3.0.5
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\
Executable files
13
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\$inst\2.tmpcompressed
MD5:8708699D2C73BED30A0A08D80F96D6D7
SHA256:A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncHelper.exeexecutable
MD5:2C56F195FD35A0D3D150989488093E63
SHA256:0FD2F8852C5ADF83C51B9910E784B95C4E0BF4DD553D19FEF81408F13AF4EDC5
78204c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\3582-490\4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeexecutable
MD5:F331E412E07F7B983FC0949E036CCBC3
SHA256:A3CA6BF622E07805D3C5A2C95CDB9E645C4176C552699AC160E0C38A0197A83F
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmpcompressed
MD5:8FD57DC4B37B9FFED049DF47CE23D862
SHA256:590137997DFF00469FE3B0D42C6D4BCCB6D39A363722528C30BBCA0F6994AE56
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\15971.vbstext
MD5:DB28C49DE866BF2D2B94188E94BDCAF0
SHA256:0BE52B249B2B73D1A70BA8D6CFB3F20D609DAF1912109E500C5A460CB69EE55C
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\rutserv.exeexecutable
MD5:123809145089775BE00FC392376BE38F
SHA256:8186F539D911E7F8841633C6F277A4A414A23FB2F989155792FB0F004C74FAA9
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\rfusclient.exeexecutable
MD5:2736534AC3AD65379869042C9BD05C54
SHA256:C614201DCE04DAC96A73DA44F7165C75A5BA202E240AECC8D98E5C9526B906FA
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Program Files (x86)\Company UFOLABS\RMSBuilder 6.3.0.5\Uninstall.initext
MD5:9EE47260B20CC6677DBDBD04B72D72E4
SHA256:1EFA8CA10F1CF99313B0F92D5A87EB5F2DE726B60953021B18AD8DC5B7E7B4C9
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\Russian.lgbinary
MD5:37B80CC200E62CDB350F7C86EE61264C
SHA256:73597E56680438F9805B5B4998D8F3C7F93F9A966E38C457E5BBAC1E45C34820
79604c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc.exeC:\Windows\spom\ses.regbinary
MD5:A61A6575D66B6C57601A6D5C158EB14B
SHA256:7C1B5160B22BE72A66869C0214A8ABBC221956A68D7A4677A62ACC1C428BBEC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
8
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5404
rutserv.exe
POST
200
31.31.198.18:80
http://rmansys.ru/utils/inet_id_notify.php
unknown
—
—
malicious
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5404
rutserv.exe
GET
200
31.31.198.18:80
http://rmansys.ru/utils/inet_id_notify.php?test=1
unknown
—
—
malicious
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5404
rutserv.exe
31.31.198.18:80
rmansys.ru
Domain names registrar REG.RU, Ltd
RU
malicious
5404
rutserv.exe
77.223.119.187:5655
rms-server.tektonit.ru
OOO Network of data-centers Selectel
RU
suspicious
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
rmansys.ru
  • 31.31.198.18
malicious
rms-server.tektonit.ru
  • 77.223.119.187
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
5404
rutserv.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
5404
rutserv.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] Remote Access Tool Has been detected
5404
rutserv.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] Remote Access Tool Has been detected
Process
Message
rutserv.exe
TMainService.Start
rutserv.exe
GUID_CONSOLE_DISPLAY_STATE
rutserv.exe
Not allowed.
rutserv.exe
28-04-2025_11:53:48:193#T:Msg code: 3
rutserv.exe
28-04-2025_11:53:48:193#T:MSG_KEEP_ALIVE
rutserv.exe
28-04-2025_11:53:48:193#T:Msg Size: 104
rutserv.exe
MSG_KEEP_ALIVE
rutserv.exe
28-04-2025_11:54:19:849#T:Msg code: 3
rutserv.exe
28-04-2025_11:54:19:849#T:Msg Size: 104
rutserv.exe
MSG_KEEP_ALIVE
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4c80796c4c8511a14e81fd2ac28275d67228aa964f9d5808f16cbabaa76dc8bc