General Info

File name

RWipeAndClean20.exe

Full analysis
https://app.any.run/tasks/8b51f3fc-9763-4cc1-a56c-7061e6bdfedb
Verdict
Malicious activity
Analysis date
3/14/2019, 09:49:16
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

02425174347ff2e5421ad17c3ed8076c

SHA1

0ff8022f6d5bb461732e795069f5bcb906b2fb1a

SHA256

ca988b691a8effd6ba6f07e8ee3bb1ab74b35fedb3dfc8b94d3a7bcd9e6ba597

SSDEEP

393216:nNUujjjjDjjmxGan02xb7wG40PS1azsuiIOT1+zg9rCbHA1xRA2hgQF:nNxjjjjDjjmdH7d4nnZ+zg9ebHA1A4X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
180 seconds
Additional time used
120 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Loads dropped or rewritten executable
  • RwcRun.exe (PID: 2976)
  • RwcRun.exe (PID: 3320)
  • regsvr32.exe (PID: 1920)
Application was dropped or rewritten from another process
  • RwcRun.exe (PID: 2976)
  • RwcRun.exe (PID: 3320)
  • RwcRun.exe (PID: 2392)
  • _RwcSetup.exe (PID: 3928)
Registers / Runs the DLL via REGSVR32.EXE
  • _RwcSetup.exe (PID: 3928)
Application launched itself
  • RwcRun.exe (PID: 2976)
Creates COM task schedule object
  • regsvr32.exe (PID: 1920)
Creates files in the program directory
  • _RwcSetup.exe (PID: 3928)
Executable content was dropped or overwritten
  • _RwcSetup.exe (PID: 3928)
  • RWipeAndClean20.exe (PID: 3424)
  • RWipeAndClean20.exe (PID: 2236)
  • RWipeAndClean20.tmp (PID: 4036)
Reads the Windows organization settings
  • RWipeAndClean20.tmp (PID: 4036)
Reads Windows owner or organization settings
  • RWipeAndClean20.tmp (PID: 4036)
Creates files in the program directory
  • RWipeAndClean20.tmp (PID: 4036)
Creates a software uninstall entry
  • RWipeAndClean20.tmp (PID: 4036)
Application was dropped or rewritten from another process
  • RWipeAndClean20.tmp (PID: 4036)
  • RWipeAndClean20.tmp (PID: 3256)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable (generic) (42.6%)
.exe
|   Win16/32 Executable Delphi generic (19.5%)
.exe
|   Generic Win/DOS Executable (18.9%)
.exe
|   DOS Executable Generic (18.9%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2018:06:14 15:27:46+02:00
PEType:
PE32
LinkerVersion:
2.25
CodeSize:
66560
InitializedDataSize:
628736
UninitializedDataSize:
null
EntryPoint:
0x1181c
OSVersion:
5
ImageVersion:
6
SubsystemVersion:
5
Subsystem:
Windows GUI
FileVersionNumber:
0.0.0.0
ProductVersionNumber:
0.0.0.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Unicode
Comments:
This installation was built with Inno Setup.
CompanyName:
R-Tools Technology Inc.
FileDescription:
R-Wipe & Clean Setup
FileVersion:
LegalCopyright:
ProductName:
R-Wipe & Clean
ProductVersion:
20.0.2227
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
14-Jun-2018 13:27:46
Detected languages
English - United States
Comments:
This installation was built with Inno Setup.
CompanyName:
R-Tools Technology Inc.
FileDescription:
R-Wipe & Clean Setup
FileVersion:
null
LegalCopyright:
null
ProductName:
R-Wipe & Clean
ProductVersion:
20.0.2227
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0050
Pages in file:
0x0002
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x000F
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x001A
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000100
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
8
Time date stamp:
14-Jun-2018 13:27:46
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x0000F25C 0x0000F400 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.37588
.itext 0x00011000 0x00000FA4 0x00001000 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 5.77877
.data 0x00012000 0x00000C8C 0x00000E00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 2.30283
.bss 0x00013000 0x000056BC 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.idata 0x00019000 0x00000E04 0x00001000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.59781
.tls 0x0001A000 0x00000008 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rdata 0x0001B000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 0.204488
.rsrc 0x0001C000 0x0009762C 0x00097800 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.92229
Resources
1

2

3

4

5

6

7

8

9

10

11

12

4091

4092

4093

4094

4095

4096

11111

CHARTABLE

DVCLAL

PACKAGEINFO

MAINICON

Imports
    oleaut32.dll

    advapi32.dll

    user32.dll

    kernel32.dll

    comctl32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
48
Monitored processes
9
Malicious processes
2
Suspicious processes
3

Behavior graph

+
drop and start start drop and start drop and start rwipeandclean20.exe rwipeandclean20.tmp no specs rwipeandclean20.exe rwipeandclean20.tmp _rwcsetup.exe regsvr32.exe no specs rwcrun.exe no specs rwcrun.exe rwcrun.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2236
CMD
"C:\Users\admin\Desktop\RWipeAndClean20.exe"
Path
C:\Users\admin\Desktop\RWipeAndClean20.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
R-Tools Technology Inc.
Description
R-Wipe & Clean Setup
Version
Modules
Image
c:\users\admin\desktop\rwipeandclean20.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\version.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shell32.dll
c:\users\admin\appdata\local\temp\is-s5m3f.tmp\rwipeandclean20.tmp

PID
3256
CMD
"C:\Users\admin\AppData\Local\Temp\is-S5M3F.tmp\RWipeAndClean20.tmp" /SL5="$30110,18491707,696320,C:\Users\admin\Desktop\RWipeAndClean20.exe"
Path
C:\Users\admin\AppData\Local\Temp\is-S5M3F.tmp\RWipeAndClean20.tmp
Indicators
No indicators
Parent process
RWipeAndClean20.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Setup/Uninstall
Version
51.1052.0.0
Modules
Image
c:\users\admin\appdata\local\temp\is-s5m3f.tmp\rwipeandclean20.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll

PID
3424
CMD
"C:\Users\admin\Desktop\RWipeAndClean20.exe" /SPAWNWND=$20122 /NOTIFYWND=$30110
Path
C:\Users\admin\Desktop\RWipeAndClean20.exe
Indicators
Parent process
RWipeAndClean20.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
R-Tools Technology Inc.
Description
R-Wipe & Clean Setup
Version
Modules
Image
c:\users\admin\desktop\rwipeandclean20.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\version.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shell32.dll
c:\users\admin\appdata\local\temp\is-jc2qj.tmp\rwipeandclean20.tmp

PID
4036
CMD
"C:\Users\admin\AppData\Local\Temp\is-JC2QJ.tmp\RWipeAndClean20.tmp" /SL5="$20128,18491707,696320,C:\Users\admin\Desktop\RWipeAndClean20.exe" /SPAWNWND=$20122 /NOTIFYWND=$30110
Path
C:\Users\admin\AppData\Local\Temp\is-JC2QJ.tmp\RWipeAndClean20.tmp
Indicators
Parent process
RWipeAndClean20.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Setup/Uninstall
Version
51.1052.0.0
Modules
Image
c:\users\admin\appdata\local\temp\is-jc2qj.tmp\rwipeandclean20.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\propsys.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\imageres.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\devrtl.dll
c:\program files\r-wipe & clean\_rwcsetup.exe

PID
3928
CMD
"C:\Program Files\R-Wipe & Clean\_RwcSetup.exe" /installrwc
Path
C:\Program Files\R-Wipe & Clean\_RwcSetup.exe
Indicators
Parent process
RWipeAndClean20.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
R-Tools Inc.
Description
R-Wipe & Clean Installer
Version
20.0.0.2227
Modules
Image
c:\program files\r-wipe & clean\_rwcsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\regsvr32.exe

PID
1920
CMD
regsvr32 /s RwcShl32.dll
Path
C:\Windows\system32\regsvr32.exe
Indicators
No indicators
Parent process
_RwcSetup.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft(C) Register Server
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\cryptbase.dll
c:\program files\r-wipe & clean\rwcshl32.dll

PID
2392
CMD
"C:\Program Files\R-Wipe & Clean\RwcRun.exe"
Path
C:\Program Files\R-Wipe & Clean\RwcRun.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
R-Tools Inc.
Description
R-Wipe & Clean
Version
20.0.0.2227
Modules
Image
c:\program files\r-wipe & clean\rwcrun.exe
c:\systemroot\system32\ntdll.dll

PID
2976
CMD
"C:\Program Files\R-Wipe & Clean\RwcRun.exe"
Path
C:\Program Files\R-Wipe & Clean\RwcRun.exe
Indicators
Parent process
––
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
R-Tools Inc.
Description
R-Wipe & Clean
Version
20.0.0.2227
Modules
Image
c:\program files\r-wipe & clean\rwcrun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\program files\r-wipe & clean\rwcdialogs.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\cryptbase.dll
c:\program files\r-wipe & clean\rwcstrings.dll
c:\program files\r-wipe & clean\rwcimages.dll
c:\program files\r-wipe & clean\rwcclassic.dll
c:\windows\system32\apphelp.dll

PID
3320
CMD
"C:\Program Files\R-Wipe & Clean\RwcRun.exe" /changeinterface
Path
C:\Program Files\R-Wipe & Clean\RwcRun.exe
Indicators
No indicators
Parent process
RwcRun.exe
User
admin
Integrity Level
HIGH
Version:
Company
R-Tools Inc.
Description
R-Wipe & Clean
Version
20.0.0.2227
Modules
Image
c:\program files\r-wipe & clean\rwcrun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\r-wipe & clean\rwcclassic.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cryptbase.dll
c:\program files\r-wipe & clean\rwcimages.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\uiribbon.dll
c:\windows\system32\uiribbonres.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\eventvwr.exe
c:\windows\explorer.exe
c:\windows\system32\cmd.exe
c:\windows\system32\control.exe
c:\program files\windows defender\msascui.exe
c:\windows\system32\wbem\winmgmt.exe
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\program files\winrar\winrar.exe
c:\program files\google\chrome\application\chrome.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\mozilla firefox\firefox.exe
c:\program files\opera\opera.exe
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\program files\filezilla ftp client\filezilla.exe
c:\program files\videolan\vlc\vlc.exe
c:\progra~1\micros~1\office14\excel.exe
c:\progra~1\micros~1\office14\onenote.exe
c:\progra~1\micros~1\office14\powerpnt.exe
c:\progra~1\micros~1\office14\winword.exe
c:\progra~1\micros~1\office14\msaccess.exe
c:\progra~1\micros~1\office14\mspub.exe
c:\program files\java\jre1.8.0_92\bin\javaws.exe
c:\program files\notepad++\notepad++.exe
c:\windows\system32\fxscover.exe
c:\windows\system32\mmc.exe
c:\windows\system32\mspaint.exe
c:\windows\system32\perfmon.exe
c:\windows\system32\mstsc.exe
c:\windows\system32\wfs.exe
c:\program files\windows mail\winmail.exe
c:\windows\ehome\ehshell.exe
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\windowspowershell\v1.0\powershell_ise.exe
c:\program files\windows nt\accessories\wordpad.exe
c:\windows\system32\xpsrchvw.exe
c:\program files\r-wipe & clean\rwcstrings.dll
c:\windows\system32\sspicli.dll

Registry activity

Total events
318
Read events
265
Write events
52
Delete events
1

Modification events

PID
Process
Operation
Key
Name
Value
4036
RWipeAndClean20.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
C40F0000E44409E942DAD401
4036
RWipeAndClean20.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
E466EB2F5E4B5ACC6E11708F89A590F29E85373C22398F5D39C2EFA4F60BF357
4036
RWipeAndClean20.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
4036
RWipeAndClean20.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0000
C:\Program Files\R-Wipe & Clean\_RwcAdds.dll
4036
RWipeAndClean20.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
7BA2A99D242187599765E9DE2F71C7A8DBB0309B67379591ACC5E20535651712
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: Setup Version
5.6.1 (u)
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: App Path
C:\Program Files\R-Wipe & Clean
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
InstallLocation
C:\Program Files\R-Wipe & Clean\
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: Icon Group
R-Wipe & Clean
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: User
admin
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: Selected Tasks
desktopicon,desktopicon\common
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: Deselected Tasks
desktopicon\user
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Inno Setup: Language
default
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
DisplayName
R-Wipe & Clean 20.0
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
DisplayIcon
C:\Program Files\R-Wipe & Clean\RwcSetup.exe
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
UninstallString
"C:\Program Files\R-Wipe & Clean\unins000.exe"
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
QuietUninstallString
"C:\Program Files\R-Wipe & Clean\unins000.exe" /SILENT
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
DisplayVersion
20.0.2227
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
Publisher
R-Tools Technology Inc.
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
URLInfoAbout
http://www.r-tt.com
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
HelpLink
http://www.r-tt.com
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
URLUpdateInfo
http://www.r-tt.com
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
NoModify
1
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
NoRepair
1
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
InstallDate
20190314
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
MajorVersion
20
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
MinorVersion
0
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
VersionMajor
20
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
VersionMinor
0
4036
RWipeAndClean20.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\R-Wipe & Clean_is1
EstimatedSize
43815
4036
RWipeAndClean20.tmp
delete key
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
PendingFileRenameOperations
\??\C:\Program Files\R-Wipe & Clean\_RwcSetup.exe
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\R-TT\RWC
Settings1
15
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{B482AE79-23AE-402E-AA76-F364C4655289}
RwcShellExtensionHandler.RwcShellExtension
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\{B482AE79-23AE-402E-AA76-F364C4655289}
RwcShellExtensionHandler.RwcShellExtension
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\{B482AE79-23AE-402E-AA76-F364C4655289}
RwcShellExtensionHandler.RwcShellExtension
3928
_RwcSetup.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\R-TT\RWC
Path
C:\Program Files\R-Wipe & Clean
1920
regsvr32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B482AE79-23AE-402E-AA76-F364C4655289}
RwcShellExtensionHandler.RwcShellExtension Class
1920
regsvr32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B482AE79-23AE-402E-AA76-F364C4655289}\InprocServer32
C:\Program Files\R-Wipe & Clean\RwcShl32.dll
1920
regsvr32.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B482AE79-23AE-402E-AA76-F364C4655289}\InprocServer32
ThreadingModel
Apartment
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Console
CursorMode1
3576128276
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Console
ScreenState1
1418200915
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Control Panel\Accessibility\Keyboard Response
Last Valid Mode1
1733434665
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Control Panel\Accessibility\SoundSentry
Mode1
3947380929
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Control Panel\Desktop
ForegroundState1
3921876137
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Control Panel\Desktop
ScreenFlags1
55137188
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation
IECompatState1
3565660492
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation
IECompatFlags1
3524273693
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
DOMNodes1
6E000000903AC5F442DAD40100000000
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Document Windows
WindowSizes1
2725478891
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
SmoothFlags1
4194977238
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
SearchFlags1
2333397469
2976
RwcRun.exe
write
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences
SQMFlags1
2931563330

Files activity

Executable files
30
Suspicious files
0
Text files
3
Unknown types
6

Dropped files

PID
Process
Filename
Type
2236
RWipeAndClean20.exe
C:\Users\admin\AppData\Local\Temp\is-S5M3F.tmp\RWipeAndClean20.tmp
executable
MD5: ce8c7be5e30df59da495256136c5b2b6
SHA256: 115ff264c52c73c1f6a255bdd455046987257a5cfb1a8c534f465a4cbbdc2b8f
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcClassic.dll
executable
MD5: d0a5ee9d52116fc8a14a287e802e7a38
SHA256: bd06e342fe01c0b9d6442371a8c1f9534412c30915d5e95772871207a75c522c
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcWork.dll
executable
MD5: 80edb204e427de2b06bdc66d262a794a
SHA256: 2b1d905b0094406c247741334d90afbc9b8a4b9838504ea1e1f217d3c4707290
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcBossKey.exe
executable
MD5: de131ab24c64ea4babdec7a0ba8eed74
SHA256: 5bd434a1e45d58749a7bdd29a3b7708dbca5378ef718af0d155802bba31817e4
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcService.exe
executable
MD5: 66424876113c418e8d87698b3f8308a8
SHA256: 15bbc15e4c722a9701537861cf82dc88cec36a587cf9e5893e5d163f285843bb
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcSecure.exe
executable
MD5: f34abbafd3455579658d6326134c8866
SHA256: 2488475518d814e67924d78729b7d03294600bb8716265e4bd5946fed48fec72
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcTouch.dll
executable
MD5: 9794e0c81c15f04e97f54edab5f6921d
SHA256: 69c253e129cfc6d282d4f6523b4f2196367853cfe8052e77251384a107b41f9f
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcAdds.dll
executable
MD5: e79c2b2df56e02d42ca10846e8123a69
SHA256: 69fbfa431b5f2739c2ebf73daa914703f2a9c1ea8ec24238a73af13543feb79d
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcClassic.dll
executable
MD5: d0a5ee9d52116fc8a14a287e802e7a38
SHA256: bd06e342fe01c0b9d6442371a8c1f9534412c30915d5e95772871207a75c522c
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\unins000.exe
executable
MD5: cf3db1c917bd0d2036713fa9449ccf54
SHA256: 8fcc11a9acbf0af9a19f2e59a4fc7bff8f8fc68d681c430b96b2b4be34195b08
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcStrings.dll
executable
MD5: 51727a4bdcaef52f0cba69d9e101918c
SHA256: f9c4e37e409215b73c65e8fbe3038f1cc7ae4a17195dd68f7fb086a495a779a9
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcDialogs.dll
executable
MD5: 9ad0d3a0dea290af3d5691547d781d42
SHA256: beca2bb1656b7c3c04d28cf92e942f72288d4eb8b1010baba38fcf41b9a28b28
3424
RWipeAndClean20.exe
C:\Users\admin\AppData\Local\Temp\is-JC2QJ.tmp\RWipeAndClean20.tmp
executable
MD5: ce8c7be5e30df59da495256136c5b2b6
SHA256: 115ff264c52c73c1f6a255bdd455046987257a5cfb1a8c534f465a4cbbdc2b8f
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcWorker.exe
executable
MD5: 60714e5dd7831053af3574043527a63a
SHA256: c6bd5d1c51957a24dfd204a1a46059257e57df79d3f1c429e029983d1ed120f1
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcShl32.dll
executable
MD5: 47f85c114587a46613fd5ed4fcc6a7d2
SHA256: aa3e227d6d598d2220d0776a9f3c0d70cdd51653fe648d34f6a9ee4201312ebc
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcScheduler.exe
executable
MD5: 7ddf425c41ddfd98d3758ddad0af70d3
SHA256: f70157142218cfc5e63bbe7f72a9e74c10fc198ec69c678fbeb38131a11b1553
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcDialogs.dll
executable
MD5: 9ad0d3a0dea290af3d5691547d781d42
SHA256: beca2bb1656b7c3c04d28cf92e942f72288d4eb8b1010baba38fcf41b9a28b28
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcTraces.dll
executable
MD5: 8859152a8c32251bcd92f9b6c44586bd
SHA256: 6aecf7f1f19e938d0921f9269730060c96179b41c6fac2bc913046bc20c7e73c
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcSmart.dll
executable
MD5: cce67f1cf18a8af1570217119777f851
SHA256: e34ff370ff0018f4c59450dcd144cb711810502a9e4c43ed93a4067c37636518
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcRun.exe
executable
MD5: 91ed7bec12e1c84608592c0f2ed50ee4
SHA256: da06dac5fa5c40fd7a282a43450012e93b25278d8617d4d7fd569848b3df04c2
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcFonts.dll
executable
MD5: 816ecc72e0dee6451be9fe0cb716cfee
SHA256: bc92a8ee8e35d8511a710a62fde702a80ff8d31761c7ab2a63ea36f9c11db05e
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcProxy.dll
executable
MD5: e8c7f510f5166632285a7c4b58f75b3f
SHA256: b60c295e259098dc3ea1b027f9b0815b35106b9a0899adfb94f6ffec24eaa04f
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcShl64.dll
executable
MD5: 53649ba18ab30ba862227edca83de915
SHA256: 7f6c34ca17573bf70d4f684b3b6867059c12ad5ab8b7a147ac20620cf40ba003
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcFonts.dll
executable
MD5: 816ecc72e0dee6451be9fe0cb716cfee
SHA256: bc92a8ee8e35d8511a710a62fde702a80ff8d31761c7ab2a63ea36f9c11db05e
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcProcs.dll
executable
MD5: 5829869759220fb9479682afea73f20f
SHA256: c48e86d7fde3a495af1e22b78c635beca558483d19fc63e8540738ff5dbdaf2e
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcMonitor.dll
executable
MD5: 145c90145faa49ac1182b959df294b10
SHA256: ef98f68c03420ddf328eb54d8c55ec47ae2f907f371ee8f868cfb32cc8b6672b
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcSetup.exe
executable
MD5: fd5bfa12bcf2f045da74d307033d97da
SHA256: b6465caa6b3851e41dec2f65f55eacad1dbc0042731062fb3198ff97ab1b95a6
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcInetAuxy.exe
executable
MD5: e4304771793dd337557996d1ba2b3786
SHA256: 828b07c3c1a1dfd90371135d76c60a5259e3136623f5efdbb091046b13776147
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcImages.dll
executable
MD5: 93a08bd5a302762617f25ab2d7e8d36a
SHA256: 83f76ca86ee8cf00082546d1f672735ff85dd57a61e9005de245ffa576699954
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_RwcAdds.dll
executable
MD5: e79c2b2df56e02d42ca10846e8123a69
SHA256: 69fbfa431b5f2739c2ebf73daa914703f2a9c1ea8ec24238a73af13543feb79d
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_eula.txt
text
MD5: 441760e0b73adf41b5f48ccb10a6ebd8
SHA256: 4f286ae4165939639216afec0f92dca555ab99a296beabaf9793434a87dcd570
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-GQJ9I.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-VV7TA.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-7VD1L.tmp
––
MD5:  ––
SHA256:  ––
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcProxy.dll
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-G90G6.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-ROVQ9.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-DMOPU.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-67AQJ.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-GTJBB.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-VNT1C.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-I8IE3.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-E47TK.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-PCCR9.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\main.ico
image
MD5: c9bfc78aac2bca94d113176abfef66ca
SHA256: 08f61758bce56b538740f7f3e81037188eea04c55220cafef1bb4165ceb4a5db
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-SI1BV.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-E3LE4.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-GC32O.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-KKKGO.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-11I49.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-J1FDO.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-GI4JQ.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\_R-Wipe & Clean.chm
chm
MD5: 295d51e73b04e707f2431c41c85314a3
SHA256: e0170b4b317da50665f06542c2542b84b1e41206b4deb2ebf7ec77a0452691df
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-5OG3S.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R-Wipe & Clean\R-Wipe & Clean.lnk
lnk
MD5: e07a59606ca221a8028f3fabb1663f1b
SHA256: 98aac2b637708fb1615efa1826961a83c41e1beafbcb839fbf5b1d8f4958dfea
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-NVJHO.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R-Wipe & Clean\R-Wipe & Clean Help.lnk
lnk
MD5: af65253800345ed1d86c764f40350d37
SHA256: a9768dbe854f05bcad9be5fb0d6bf32ab1e70eb39f9fcd8ef3c81251c67ba157
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-G9CEV.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R-Wipe & Clean\License Agreement.lnk
lnk
MD5: deebbdb078d2d15d0beb392f6e940bb4
SHA256: 9553f02737e743261299b996e894757aec4a67c256e8c6dea911f3360b847f88
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-D9R32.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Users\Public\Desktop\R-Wipe & Clean.lnk
lnk
MD5: a5fd004befbd81e70c9178aed6548fb0
SHA256: d7ba8b9c9d79b3740b495b75672f6681e781fc0f88bb7fa2c58e071579843fd2
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-NT79U.tmp
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\unins000.dat
dat
MD5: f1a2c47e84b90fe37d91cd601ebcbc0a
SHA256: 30f79d25e1d5f3899845a3f3162e4096a753a331a1d942ce4a83730b1b8ee08c
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-E83JI.tmp
––
MD5:  ––
SHA256:  ––
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\eula.txt
text
MD5: 441760e0b73adf41b5f48ccb10a6ebd8
SHA256: 4f286ae4165939639216afec0f92dca555ab99a296beabaf9793434a87dcd570
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-VHE3U.tmp
––
MD5:  ––
SHA256:  ––
3928
_RwcSetup.exe
C:\Program Files\R-Wipe & Clean\RwcImages.dll
––
MD5:  ––
SHA256:  ––
4036
RWipeAndClean20.tmp
C:\Program Files\R-Wipe & Clean\is-8T0U9.tmp
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

No network activity.

Debug output strings

No debug info.