b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18

Analysis

max time kernel
152s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe
Size

17.2MB
MD5

850d8d031e7ef7aff148df081191570b
SHA1

38f7c2796aee9c9c09a67e8c4c99a02d2ec1b346
SHA256

b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18
SHA512

84bbad6cd5d1d754da3bc7713e660061d08b2bd799599b554ed066dc76d9e008dd5a1f3e0dfe747612942d072d8c744c5ef749fd1bbf2ea4faf2f8f31bed72bd

Score

8^/10

discovery

Malware Config

Signatures

Blacklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

4 1336 msiexec.exe
6 1336 msiexec.exe
8 1336 msiexec.exe
Executes dropped EXE 8 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid process

1712 rfusclient.exe
952 rutserv.exe
1548 rutserv.exe
2008 rutserv.exe
1380 rutserv.exe
1056 rfusclient.exe
1676 rfusclient.exe
1556 rfusclient.exe

flow	pid	process
4	1336	msiexec.exe
6	1336	msiexec.exe
8	1336	msiexec.exe

pid	process
1712	rfusclient.exe
952	rutserv.exe
1548	rutserv.exe
2008	rutserv.exe
1380	rutserv.exe
1056	rfusclient.exe
1676	rfusclient.exe
1556	rfusclient.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exerfusclient.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 9 IoCs

Processes:

MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid process

1040 MsiExec.exe
952 rutserv.exe
952 rutserv.exe
1548 rutserv.exe
1548 rutserv.exe
2008 rutserv.exe
2008 rutserv.exe
1380 rutserv.exe
1380 rutserv.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1040	MsiExec.exe
952	rutserv.exe
952	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

JavaScript code in executable 5 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	js
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	js
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	js
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	js
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	js

Drops file in Program Files directory 72 IoCs

Processes:

msiexec.exerutserv.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows8\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2020-11.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\drvinstaller32.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\drvinstaller64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows8\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows10\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows8\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows10\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe

Drops file in Windows directory 18 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f74cca4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD11.tmp	msiexec.exe
File created	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File created	C:\Windows\Installer\f74cca2.msi	msiexec.exe
File created	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f74cca2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID785.tmp	msiexec.exe
File created	C:\Windows\Installer\f74cca4.ipi	msiexec.exe
File created	C:\Windows\Installer\f74cca6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 26 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B4A3085EB4A56F447A9588F26BDA9728	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\PackageName = "host.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RMS_{B9A0AC9D-45BB-48AB-A87D-7FBDA70C40E6}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\2 = "C:\\ProgramData\\Remote Manipulator System\\msi\\69110_{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\PackageCode = "B39B0F2EBB537BF46A58ECBDE554B477"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Version = "117436076"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RMS_{B9A0AC9D-45BB-48AB-A87D-7FBDA70C40E6}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductIcon = "C:\\Windows\\Installer\\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\monitor_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	process
1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe
1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1056	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

1556 rfusclient.exe

pid	process
1556	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 114 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	996	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeSecurityPrivilege	1336	msiexec.exe
Token: SeCreateTokenPrivilege	996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	996	msiexec.exe
Token: SeLockMemoryPrivilege	996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	996	msiexec.exe
Token: SeMachineAccountPrivilege	996	msiexec.exe
Token: SeTcbPrivilege	996	msiexec.exe
Token: SeSecurityPrivilege	996	msiexec.exe
Token: SeTakeOwnershipPrivilege	996	msiexec.exe
Token: SeLoadDriverPrivilege	996	msiexec.exe
Token: SeSystemProfilePrivilege	996	msiexec.exe
Token: SeSystemtimePrivilege	996	msiexec.exe
Token: SeProfSingleProcessPrivilege	996	msiexec.exe
Token: SeIncBasePriorityPrivilege	996	msiexec.exe
Token: SeCreatePagefilePrivilege	996	msiexec.exe
Token: SeCreatePermanentPrivilege	996	msiexec.exe
Token: SeBackupPrivilege	996	msiexec.exe
Token: SeRestorePrivilege	996	msiexec.exe
Token: SeShutdownPrivilege	996	msiexec.exe
Token: SeDebugPrivilege	996	msiexec.exe
Token: SeAuditPrivilege	996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	996	msiexec.exe
Token: SeChangeNotifyPrivilege	996	msiexec.exe
Token: SeRemoteShutdownPrivilege	996	msiexec.exe
Token: SeUndockPrivilege	996	msiexec.exe
Token: SeSyncAgentPrivilege	996	msiexec.exe
Token: SeEnableDelegationPrivilege	996	msiexec.exe
Token: SeManageVolumePrivilege	996	msiexec.exe
Token: SeImpersonatePrivilege	996	msiexec.exe
Token: SeCreateGlobalPrivilege	996	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rfusclient.exe

pid process

1676 rfusclient.exe
1676 rfusclient.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

rfusclient.exe

pid process

1676 rfusclient.exe
1676 rfusclient.exe

pid	process
1676	rfusclient.exe
1676	rfusclient.exe

pid	process
1676	rfusclient.exe
1676	rfusclient.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
952	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
1548	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
2008	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe
1380	rutserv.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exemsiexec.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1584 wrote to memory of 996	1584	SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe	msiexec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1040	1336	msiexec.exe	MsiExec.exe
PID 1336 wrote to memory of 1712	1336	msiexec.exe	rfusclient.exe
PID 1336 wrote to memory of 1712	1336	msiexec.exe	rfusclient.exe
PID 1336 wrote to memory of 1712	1336	msiexec.exe	rfusclient.exe
PID 1336 wrote to memory of 1712	1336	msiexec.exe	rfusclient.exe
PID 1336 wrote to memory of 952	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 952	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 952	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 952	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 1548	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 1548	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 1548	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 1548	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 2008	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 2008	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 2008	1336	msiexec.exe	rutserv.exe
PID 1336 wrote to memory of 2008	1336	msiexec.exe	rutserv.exe
PID 1380 wrote to memory of 1676	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1676	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1676	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1676	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1056	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1056	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1056	1380	rutserv.exe	rfusclient.exe
PID 1380 wrote to memory of 1056	1380	rutserv.exe	rfusclient.exe
PID 1056 wrote to memory of 1556	1056	rfusclient.exe	rfusclient.exe
PID 1056 wrote to memory of 1556	1056	rfusclient.exe	rfusclient.exe
PID 1056 wrote to memory of 1556	1056	rfusclient.exe	rfusclient.exe
PID 1056 wrote to memory of 1556	1056	rfusclient.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.850d8d031e7ef7af.27396.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RMS_{B9A0AC9D-45BB-48AB-A87D-7FBDA70C40E6}\host.msi" /qn
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blacklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7DB646208C0EA4B2ABB2B6DB8659881A
2⤵
- Loads dropped DLL
PID:1040

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RMS_{B9A0AC9D-45BB-48AB-A87D-7FBDA70C40E6}\host.msi"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:1712

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: SetClipboardViewer
PID:1556

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Remote Manipulator System - Host\English.lg
MD5
246286feb0ed55eaf4251e256d2fe47e

SHA1
bc76b013918e4c1bd6dff44708a760496d8c717c

SHA256
64c70065830cc623be55c73a940aa3da57c134ee459afbd983ff17960dc57c27

SHA512
900e670259fb3b5762c0242236ce86fcdd04300407fc4d79959edfed99bbec58b4e10048a2b9ef54e709d00717870bf09c7b5fb2f5fa3cfe844682d2bb36f12f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg
MD5
55a0b95a1d1b7e309f2c22af82a07cc0

SHA1
521c41e185e5b5e73cfc4e1b18646dc4ed171942

SHA256
704a1a83d11c21717c17e6a7eb264d94a98d45a7c1aba8ebb82fafc65f4f199d

SHA512
38e3a8392f84cd31b9eb12ce4fa7ed04db29f4fe4de95e52f18cdc6e7c74a0b2673d15ab40802bf289ed3a1e83526827b012ceddbb309f40c5302547ce39f5f9

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
MD5
cd97f125a6462574065fd1e3854f9d7f

SHA1
fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

SHA256
b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

SHA512
5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
MD5
cd97f125a6462574065fd1e3854f9d7f

SHA1
fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

SHA256
b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

SHA512
5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
MD5
cd97f125a6462574065fd1e3854f9d7f

SHA1
fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

SHA256
b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

SHA512
5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
MD5
cd97f125a6462574065fd1e3854f9d7f

SHA1
fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

SHA256
b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

SHA512
5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
MD5
cd97f125a6462574065fd1e3854f9d7f

SHA1
fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

SHA256
b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

SHA512
5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
MD5
55d66bd554511f803bebead2bd1bfde0

SHA1
34d8176565909b7b756d92a32cd8a50185f998f1

SHA256
decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

SHA512
cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
MD5
55d66bd554511f803bebead2bd1bfde0

SHA1
34d8176565909b7b756d92a32cd8a50185f998f1

SHA256
decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

SHA512
cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
MD5
55d66bd554511f803bebead2bd1bfde0

SHA1
34d8176565909b7b756d92a32cd8a50185f998f1

SHA256
decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

SHA512
cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
MD5
55d66bd554511f803bebead2bd1bfde0

SHA1
34d8176565909b7b756d92a32cd8a50185f998f1

SHA256
decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

SHA512
cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
MD5
55d66bd554511f803bebead2bd1bfde0

SHA1
34d8176565909b7b756d92a32cd8a50185f998f1

SHA256
decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

SHA512
cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll
MD5
1ea62293ac757a0c2b64e632f30db636

SHA1
8c8ac6f8f28f432a514c3a43ea50c90daf66bfba

SHA256
970cb3e00fa68daec266cd0aa6149d3604cb696853772f20ad67555a2114d5df

SHA512
857872a260cd590bd533b5d72e6e830bb0e4e037cb6749bb7d6e1239297f21606cdbe4a0fb1492cdead6f46c88dd9eb6fab5c6e17029f7df5231cefc21fa35ab

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll
MD5
89770647609ac26c1bbd9cf6ed50954e

SHA1
349eed120070bab7e96272697b39e786423ac1d3

SHA256
7b4fc8e104914cdd6a7bf3f05c0d7197cfcd30a741cc0856155f2c74e62005a4

SHA512
a98688f1c80ca79ee8d15d680a61420ffb49f55607fa25711925735d0e8dbc21f3b13d470f22e0829c72a66a798eee163411b2f078113ad8153eed98ef37a2cc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll
MD5
d29f7070ee379544aeb19913621c88e6

SHA1
499dcdb39862fd8ff5cbc4b13da9c465bfd5f4be

SHA256
654f43108fbd56bd2a3c5a3a74a2ff3f19ea9e670613b92a624e86747a496caf

SHA512
4ead1c8e0d33f2a6c35163c42e8f0630954de67e63bcadca003691635ccf8bfe709363ec88edb387b956535fdb476bc0b5773ede5b19cacf4858fb50072bbef5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll
MD5
7a9eeac3ceaf7f95f44eb5c57b4db2e3

SHA1
be1048c254aa3114358f76d08c55667c4bf2d382

SHA256
b497d07ed995b16d1146209158d3b90d85c47a643fbf25a5158b26d75c478c88

SHA512
b68fa132c3588637d62a1c2bce8f8acc78e6e2f904a53644d732dc0f4e4fbc61a2829a1ac8f6b97fe4be4f3613ef92c43e6f2ab29c6abd968acc5acd635c990d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll
MD5
5308b9945e348fbe3a480be06885434c

SHA1
5c3cb39686cca3e9586e4b405fc8e1853caaf8ff

SHA256
9dc30fb2118aad48f6a5e0a82504f365fe40abb3134f6cceeb65859f61ad939a

SHA512
4d7f08dc738a944bcee9b013b13d595e9c913b248c42a6c095cbdfc6059da7f04cca935841ff8a43687b75bdc5af05e888241e52ef594aa752ba9425cf966412

Download Submit
C:\ProgramData\Remote Manipulator System\install.log
MD5
c08c47396fc7f94fcc5501f2ca1de43a

SHA1
f62659945a3f42612438aa598e78be23fb0db7c0

SHA256
e44a3ee20ef8bae7963c4623abbe2f3bf69712400e4a95b910ac917667c4bb31

SHA512
861eb4121a74937dd1b36ddb283a8cc351ee95a083918550401e2434354127a6ad736daadd086fae1283760b2828b0baa53937586c743a88d44a83ea7f2615d0

Download Submit
C:\ProgramData\Remote Manipulator System\install.log
MD5
e6b037479046d5b6655e9c9f8b5e9024

SHA1
139ff47d9f9c2733450798c1db7a51600d7dcaa3

SHA256
04c4eb3077d3e97f59ee9af00d606a63ac927b52e729ddad8672c39d8f83c840

SHA512
54bf90d12e659f108ccadc1b154bb965bf8fcdae39528f3138caf61db83af00ccb39ce9706b49878d93030e2c110f7ba8ca0f348ff4137837091cdde828e4cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS_{B9A0AC9D-45BB-48AB-A87D-7FBDA70C40E6}\host.msi
MD5
446ac56b1ad66ad6b89f74a11d760a10

SHA1
eaf117562c436cdd8ed445533f7f732c679fd6e7

SHA256
fac5d11d3fba654e3b650238738b27b5efd25f2dbb08621ec35fc2e7a4f01076

SHA512
1b6d36a81236be19772720bbf8572ead04da2984446972af7d2e4ca4a4a673b0d71e29db4dc6b665f6e325cb81c4f70c71140f096a578aa256ef214d8b81d686

Download Submit
C:\Windows\Installer\MSID785.tmp
MD5
52185b209cfdb02d88b4a40a4bdf0911

SHA1
aa35fedfeefbee93bcca5a30feed8d240e2d1c95

SHA256
756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492

SHA512
8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\Windows\Installer\MSID785.tmp
MD5
52185b209cfdb02d88b4a40a4bdf0911

SHA1
aa35fedfeefbee93bcca5a30feed8d240e2d1c95

SHA256
756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492

SHA512
8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3

Download Submit
memory/952-30-0x0000000003ED0000-0x0000000003EE1000-memory.dmp

Filesize
68KB

Download
memory/952-22-0x0000000000000000-mapping.dmp

Download
memory/952-28-0x0000000003ED0000-0x0000000003EE1000-memory.dmp

Filesize
68KB

Download
memory/952-464-0x0000000003ED0000-0x0000000003EE1000-memory.dmp

Filesize
68KB

Download
memory/952-463-0x00000000042E0000-0x00000000042F1000-memory.dmp

Filesize
68KB

Download
memory/952-29-0x00000000042E0000-0x00000000042F1000-memory.dmp

Filesize
68KB

Download
memory/952-462-0x0000000003ED0000-0x0000000003EE1000-memory.dmp

Filesize
68KB

Download
memory/996-890-0x0000000002280000-0x0000000002284000-memory.dmp

Filesize
16KB

Download
memory/996-10-0x0000000000000000-mapping.dmp

Download
memory/1040-12-0x0000000000000000-mapping.dmp

Download
memory/1056-1621-0x0000000003900000-0x0000000003911000-memory.dmp

Filesize
68KB

Download
memory/1056-1622-0x0000000003D10000-0x0000000003D21000-memory.dmp

Filesize
68KB

Download
memory/1056-1618-0x0000000000000000-mapping.dmp

Download
memory/1336-881-0x0000000002710000-0x0000000002730000-memory.dmp

Filesize
128KB

Download
memory/1336-886-0x0000000001360000-0x0000000001364000-memory.dmp

Filesize
16KB

Download
memory/1336-18-0x0000000003800000-0x0000000003804000-memory.dmp

Filesize
16KB

Download
memory/1336-15-0x0000000002E80000-0x0000000002E84000-memory.dmp

Filesize
16KB

Download
memory/1336-17-0x0000000003800000-0x0000000003804000-memory.dmp

Filesize
16KB

Download
memory/1336-878-0x0000000003800000-0x0000000003804000-memory.dmp

Filesize
16KB

Download
memory/1336-21-0x0000000003800000-0x0000000003804000-memory.dmp

Filesize
16KB

Download
memory/1336-16-0x0000000002920000-0x0000000002924000-memory.dmp

Filesize
16KB

Download
memory/1380-932-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download
memory/1380-1153-0x0000000003470000-0x0000000003481000-memory.dmp

Filesize
68KB

Download
memory/1380-931-0x00000000021E0000-0x00000000021F1000-memory.dmp

Filesize
68KB

Download
memory/1380-933-0x00000000021E0000-0x00000000021F1000-memory.dmp

Filesize
68KB

Download
memory/1380-1154-0x0000000003060000-0x0000000003071000-memory.dmp

Filesize
68KB

Download
memory/1380-1152-0x0000000003060000-0x0000000003071000-memory.dmp

Filesize
68KB

Download
memory/1548-470-0x0000000003F10000-0x0000000003F21000-memory.dmp

Filesize
68KB

Download
memory/1548-471-0x0000000004320000-0x0000000004331000-memory.dmp

Filesize
68KB

Download
memory/1548-472-0x0000000003F10000-0x0000000003F21000-memory.dmp

Filesize
68KB

Download
memory/1548-466-0x0000000000000000-mapping.dmp

Download
memory/1556-1623-0x0000000000000000-mapping.dmp

Download
memory/1584-4-0x00000000057F0000-0x0000000005801000-memory.dmp

Filesize
68KB

Download
memory/1584-5-0x00000000057F0000-0x0000000005801000-memory.dmp

Filesize
68KB

Download
memory/1584-2-0x00000000053E0000-0x00000000053F1000-memory.dmp

Filesize
68KB

Download
memory/1584-1-0x00000000057F0000-0x0000000005801000-memory.dmp

Filesize
68KB

Download
memory/1584-0-0x00000000053E0000-0x00000000053F1000-memory.dmp

Filesize
68KB

Download
memory/1676-1617-0x0000000000000000-mapping.dmp

Download
memory/1712-19-0x0000000000000000-mapping.dmp

Download
memory/2008-882-0x0000000003E80000-0x0000000003E91000-memory.dmp

Filesize
68KB

Download
memory/2008-876-0x0000000000000000-mapping.dmp

Download
memory/2008-883-0x0000000004290000-0x00000000042A1000-memory.dmp

Filesize
68KB

Download
memory/2008-884-0x0000000003E80000-0x0000000003E91000-memory.dmp

Filesize
68KB

Download