Malware Analysis Report

2024-11-30 19:50

Sample ID 211229-nlssnaddak
Target tmp/fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe
SHA256 3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4
Tags
rms discovery evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

Threat Level: Known bad

The file tmp/fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe was found to be: Known bad.

Malicious Activity Summary

rms discovery evasion persistence rat trojan

RMS

Executes dropped EXE

Blocklisted process makes network request

Sets file execution options in registry

Downloads MZ/PE file

Loads dropped DLL

Modifies powershell logging option

Checks installed software on the system

Modifies WinLogon

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: SetClipboardViewer

Gathers network information

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-12-29 11:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-12-29 11:29

Reported

2021-12-29 11:31

Platform

win7-en-20211208

Max time kernel

98s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe"

Signatures

RMS

trojan rat rms

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adm = "0" C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A

Modifies powershell logging option

evasion

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
File created C:\Windows\Installer\f76bf69.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76bf6b.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76bf6d.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76bf6b.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76bf69.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC3A7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC637.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 656 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 656 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 656 wrote to memory of 1252 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 856 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\chcp.com
PID 856 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\chcp.com
PID 856 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\chcp.com
PID 856 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 856 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1000 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1572 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1496 wrote to memory of 788 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe

"C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8f94smgx.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD450.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD440.tmp"

C:\Windows\system32\chcp.com

"C:\Windows\system32\chcp.com" 437

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy reset

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

"C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe"

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding A73C8E42006320536EDD5E741232C0A3

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 msupdate.info udp
US 8.8.8.8:53 csc3-2004-crl.verisign.com udp
US 8.8.8.8:53 msupdate.info udp
LT 5.133.65.53:443 msupdate.info tcp
LT 5.133.65.53:80 msupdate.info tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:5650 tcp
RU 77.247.243.43:5655 tcp
LT 5.133.65.53:443 msupdate.info tcp
RU 77.247.243.43:5655 tcp

Files

memory/856-55-0x00000000005C0000-0x00000000005C2000-memory.dmp

memory/856-54-0x000007FEF2CE0000-0x000007FEF3D76000-memory.dmp

memory/856-56-0x000007FEF1FF0000-0x000007FEF2B4D000-memory.dmp

memory/656-57-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\8f94smgx.cmdline

MD5 aef175ea9cd84e43740d5b63af215863
SHA1 149ec64dd11d9a7cce65dd1be83029c035396deb
SHA256 010c1c18b903e279a700417a3cd54c8f42773aaac150e7c7ccb5d40c80aa9e65
SHA512 b4e84d59bf8241d471cd6e6b11ea061ece3cdd4fde4c712ca524ab52df8bdb57112eb8fa4e434ae8f7852d155a1c5c3cddcbc99fabfb8cc4332cf6d5df19b368

\??\c:\Users\Admin\AppData\Local\Temp\8f94smgx.0.cs

MD5 1640a04633fee0dfdc7e22c4f4063bf6
SHA1 3cb525c47b5dd37f8ee45b034c9452265fba5476
SHA256 55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0
SHA512 85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

memory/656-60-0x00000000022C0000-0x00000000022C2000-memory.dmp

memory/1252-61-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSCD440.tmp

MD5 f25b020fbf23ad85819b842afa6a4b7f
SHA1 1553bedc146849ecdd21c85d82326c8b21f21618
SHA256 42c6dede64525b15c73518ef67b800266f60bc1c9118e7e5e419258477aacc2d
SHA512 c08a19ecf1d412b20e914e62a0efa17eff458a0b46081e017caee2033a0bc571c85d8dc0b8c665796237dbba0ddaede63ec24f2e43106911aed0cd52d4bf0d7d

C:\Users\Admin\AppData\Local\Temp\RESD450.tmp

MD5 8d2ed10084d15847c218e799b1cf9b2e
SHA1 8093555468fb6900d6aa2c7d2993e36bb52453ef
SHA256 98f714b71a8335d40b5132036c4f74e6ca29f206d8e270eb1483269dcd626273
SHA512 c0cbd4f853438f7b9e46ea21983ef486f37a1695c23b4533b31b47885e83761bfe955245f56f8824987f70e0a77ced6bbca22f578efee0b3bcf28d29354a8bce

C:\Users\Admin\AppData\Local\Temp\8f94smgx.dll

MD5 1236d5dae832f49db9fd6e06eb5ec121
SHA1 25293ef8270630395eb401925a50d4063fbf935a
SHA256 5d3aec4d6713dabc0494700f69c92663b4e9dd603648129479538b3993d6cf95
SHA512 bfd7336fe0ef96616252a0d44b2ab290722ad186e5e69fc249b0bde2da9bf721bc9d50537a76fdad40745de953b94979508fc07b3e33b1f649f2fa0d05c9a4d4

C:\Users\Admin\AppData\Local\Temp\8f94smgx.pdb

MD5 81696225767cbd1c2dee7bae5cb23197
SHA1 590e87d8703354503b017fe7500ea2c87bb87682
SHA256 193a029d22aefffbcfedb2d1432f0ae84913bf42a0e19ddfb58af940640109d1
SHA512 f8ef37dd32bcaf81a2b4fce226bc1a9e4784ef54f997cdda28a30b487035a11f29086a69d6a73029399312ea5372bf6875830bcb263ad0a337d4fa53c30445d4

memory/1372-66-0x0000000000000000-mapping.dmp

memory/1968-67-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

memory/792-68-0x0000000000000000-mapping.dmp

memory/656-70-0x0000000000000000-mapping.dmp

memory/1380-71-0x0000000000000000-mapping.dmp

memory/1620-72-0x0000000000000000-mapping.dmp

memory/1592-73-0x0000000000000000-mapping.dmp

memory/1624-75-0x0000000000000000-mapping.dmp

memory/1780-77-0x0000000000000000-mapping.dmp

memory/1300-79-0x0000000000000000-mapping.dmp

memory/1904-81-0x0000000000000000-mapping.dmp

memory/892-83-0x0000000000000000-mapping.dmp

memory/1528-84-0x0000000000000000-mapping.dmp

memory/560-85-0x0000000000000000-mapping.dmp

memory/856-86-0x00000000005ED000-0x00000000005EF000-memory.dmp

memory/856-87-0x000000001AD20000-0x000000001AD39000-memory.dmp

memory/1000-88-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

memory/1000-90-0x0000000075891000-0x0000000075893000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1572-93-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi

MD5 73e578a44265558d3ace212869d43cbb
SHA1 d2c15578def8996ed0ae4a44754055b774b095a7
SHA256 8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4
SHA512 fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4

memory/544-98-0x0000000000000000-mapping.dmp

memory/1572-100-0x00000000001D0000-0x00000000001D1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10898aded77a8968aac272b7b652663a
SHA1 08f974df65f15744515b315ac3e431cb4f7325a6
SHA256 573d094fb4f1d10a2673f634d7a392d5250c2bfc25dda019be9faf6d6b3916fc
SHA512 b09882a37ea89fe6224460ff6b1b91577c978e1fe7cf77f5810ae97330043021977bafc32bc230133234795bfadaccc5e699a32448fa045be47d88538ed16ae5

memory/788-103-0x0000000000000000-mapping.dmp

C:\Windows\Installer\MSIC3A7.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

\Windows\Installer\MSIC3A7.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

memory/2020-107-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1820-111-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/2020-114-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/1820-115-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1584-116-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1500-121-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\killself.bat

MD5 c2ac85b000427a4a00f19da237aaaf86
SHA1 459ecb5e64576348e6c654724e87825772c06ea8
SHA256 b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352
SHA512 e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b

C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

MD5 bc25377ade68750b834c81fa71c233b8
SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

MD5 2ddfa39f5c2fd3f00681ef2970617e4b
SHA1 8152aa18afbacf398b92168995ec8696d3fe3659
SHA256 f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512 f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

MD5 e38372f576d927f525ef8e1a34b54664
SHA1 26af9d1db0a3f91d7fe13147e55f06c302d59389
SHA256 4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b
SHA512 78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

MD5 eeb2c52abbc7eb1c029b7fec45a7f22e
SHA1 8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256 c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA512 0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

MD5 038bf9f3a58560ad1130eeb85cdc1a87
SHA1 3571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256 d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA512 8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

MD5 4570f7a40357016c97afe0dd4faf749b
SHA1 ebc8a1660f1103c655559caab3a70ec23ca187f1
SHA256 a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8
SHA512 6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

MD5 292a1748850d1fdc91d4ec23b02d6902
SHA1 8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256 acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512 cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

MD5 3d0b27b3f8aa22575aa0faf0b2d67216
SHA1 39fc787538849692ed7352418616f467b7a86a1d
SHA256 d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44
SHA512 19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

MD5 e44e34bc285b709f08f967325d9c8be1
SHA1 e73f05c6a980ec9d006930c5343955f89579b409
SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

memory/1584-133-0x0000000000230000-0x0000000000231000-memory.dmp

memory/868-134-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1044-137-0x0000000000000000-mapping.dmp

\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

memory/1852-138-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

memory/1852-143-0x00000000001C0000-0x00000000001C1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-12-29 11:29

Reported

2021-12-29 11:31

Platform

win10-en-20211208

Max time kernel

113s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe"

Signatures

RMS

trojan rat rms

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adm = "0" C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A

Modifies powershell logging option

evasion

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
File opened for modification C:\Windows\Installer\MSI382E.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f77361e.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
File created C:\Windows\Installer\SourceHash{D9E14363-FD66-419D-9DC9-C62471755C9F} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f77361b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3A90.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f77361b.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 3160 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2280 wrote to memory of 964 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2280 wrote to memory of 964 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3160 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\chcp.com
PID 3160 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\chcp.com
PID 3160 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3160 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 68 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 68 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 3160 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 3160 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
PID 2260 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 2260 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 2260 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1940 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1940 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1940 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 2616 wrote to memory of 2144 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2616 wrote to memory of 2144 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2616 wrote to memory of 2144 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2616 wrote to memory of 308 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 308 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 308 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 1064 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 1064 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 2616 wrote to memory of 1064 N/A C:\Windows\system32\msiexec.exe C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
PID 1940 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\cmd.exe
PID 1940 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\cmd.exe
PID 1940 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\cmd.exe
PID 1124 wrote to memory of 2176 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 1124 wrote to memory of 2176 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 1124 wrote to memory of 2176 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 1124 wrote to memory of 2520 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 1124 wrote to memory of 2520 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 1124 wrote to memory of 2520 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 2520 wrote to memory of 2168 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 2520 wrote to memory of 2168 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
PID 2520 wrote to memory of 2168 N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe

"C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cxum69oc.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES440B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC440A.tmp"

C:\Windows\system32\chcp.com

"C:\Windows\system32\chcp.com" 437

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy reset

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

"C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe"

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F364BD36C0883B21D73DBA3BFA659B77

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"

C:\Windows\system32\compattelrunner.exe

C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp
US 8.8.8.8:53 msupdate.info udp
US 8.8.8.8:53 msupdate.info udp
LT 5.133.65.53:443 msupdate.info tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:5650 tcp
RU 77.247.243.43:5655 tcp
LT 5.133.65.53:443 msupdate.info tcp
RU 77.247.243.43:5655 tcp

Files

memory/3160-115-0x0000000002840000-0x0000000002842000-memory.dmp

memory/3160-116-0x00007FFE21F40000-0x00007FFE22A9D000-memory.dmp

memory/2280-117-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\cxum69oc.cmdline

MD5 0a2da3010eb7ba0d7bc059f58d48f833
SHA1 d12d06c34668951b9ce8345b6b8e15e590e3f3f5
SHA256 d57e487035ae1a703237b6e3630d40c5f750146adcc623f30d1354f20a2eba33
SHA512 3f462120514562ebe35c381eb274e4d09c1439f8cb4453ae362b3cdfc7f3dd8410eb9a3322786756fbba4fed0aa437284f27f094217a5b70353c5c1977aa40c9

\??\c:\Users\Admin\AppData\Local\Temp\cxum69oc.0.cs

MD5 1640a04633fee0dfdc7e22c4f4063bf6
SHA1 3cb525c47b5dd37f8ee45b034c9452265fba5476
SHA256 55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0
SHA512 85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

memory/964-120-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC440A.tmp

MD5 72cb6c3b10d2f6c7e2188d9ddf6c601d
SHA1 3c64773c8190b860fde4a39690a03472c376f2a2
SHA256 e77faa69a068d60ed955ec93c365e7363568a7c0e48333d5e8b208a84dd02a87
SHA512 76bd71a7ed80eac038897c45c3982cd18ed34c130b1b191c333ab068b86ad23f6d306c37b0cc4e6a207ed8dfdfe2366a76fdff4d3759f8432c1b329412d82f3b

C:\Users\Admin\AppData\Local\Temp\RES440B.tmp

MD5 070edbfaab3d2bf0a7d5cb55ead3d55c
SHA1 7d08bd39a3e2b7be84c644956a573297cebc8c80
SHA256 696c67f605b7bdd5c8b019f348d1b877611b7f6569e7ba8cb0d916c355a75d80
SHA512 1a536cbaa5c7e233a2244c105fdd0280c6982d4a5b46e05be2e681aebe997bd3ee0fb8e8fde10c4877fd12c9ede07074845aeb45e9667edc7a0722f83b8154f0

C:\Users\Admin\AppData\Local\Temp\cxum69oc.dll

MD5 84f3fd91b53626545aae293e424e9b27
SHA1 046c481728520fb44a68e8680caea9204007718c
SHA256 94b08b6b83a18e192fcdeb4ee1c8d99ac9b70190f89b287680c8f71a86eb2591
SHA512 feee497f69472a53b7e0b61a9dd5138e45da8435bebdd25c756e1390dabe099637ed163ba4bda41e8e77be895474a761d08a6111ff000f5b4a398f5106da48d3

C:\Users\Admin\AppData\Local\Temp\cxum69oc.pdb

MD5 60a2e322e157bcca475f39b80273647c
SHA1 27fbe035de965e4d4d269ece2b99303220796da7
SHA256 cd3984a4535d50ecafb5760aa6b018a2b3c1cb4c6c2ef5b3917f569827a1368f
SHA512 2dd2b0f238bc72574c528ef71090cdc928df84cf4e38388fc25ff0b15d9fd62741b18a3c48c8d7868785eae47864e429eea9ed46c46c338b55e43d2cc947677f

memory/996-125-0x0000000000000000-mapping.dmp

memory/2280-126-0x0000000000930000-0x0000000000932000-memory.dmp

memory/440-127-0x00000213CBF90000-0x00000213CBF92000-memory.dmp

memory/440-128-0x00000213CBF90000-0x00000213CBF92000-memory.dmp

memory/3168-129-0x0000000000000000-mapping.dmp

memory/1252-130-0x0000000000000000-mapping.dmp

memory/3860-131-0x0000000000000000-mapping.dmp

memory/980-132-0x0000000000000000-mapping.dmp

memory/1048-133-0x0000000000000000-mapping.dmp

memory/2440-134-0x0000000000000000-mapping.dmp

memory/3720-135-0x0000000000000000-mapping.dmp

memory/3116-136-0x0000000000000000-mapping.dmp

memory/68-137-0x0000000000000000-mapping.dmp

memory/3160-138-0x0000000002846000-0x0000000002848000-memory.dmp

memory/2260-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

memory/1940-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1940-145-0x0000000000B00000-0x0000000000B01000-memory.dmp

memory/1320-146-0x0000000000000000-mapping.dmp

memory/1320-147-0x0000000000E00000-0x0000000000E01000-memory.dmp

memory/1320-148-0x0000000000E00000-0x0000000000E01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi

MD5 73e578a44265558d3ace212869d43cbb
SHA1 d2c15578def8996ed0ae4a44754055b774b095a7
SHA256 8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4
SHA512 fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2616-151-0x000002561C240000-0x000002561C242000-memory.dmp

memory/2616-152-0x000002561C240000-0x000002561C242000-memory.dmp

memory/2144-153-0x0000000000000000-mapping.dmp

memory/2144-154-0x0000000000470000-0x0000000000471000-memory.dmp

memory/2144-155-0x0000000000470000-0x0000000000471000-memory.dmp

C:\Windows\Installer\MSI382E.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

\Windows\Installer\MSI382E.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

memory/308-158-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/308-161-0x0000000002680000-0x0000000002681000-memory.dmp

memory/3168-162-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1064-164-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/3168-168-0x0000000000C50000-0x0000000000C51000-memory.dmp

memory/1064-169-0x0000000000B40000-0x0000000000B41000-memory.dmp

memory/1360-167-0x0000000000000000-mapping.dmp

memory/1124-170-0x00000000001D0000-0x00000000001F3000-memory.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

MD5 e38372f576d927f525ef8e1a34b54664
SHA1 26af9d1db0a3f91d7fe13147e55f06c302d59389
SHA256 4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b
SHA512 78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

MD5 eeb2c52abbc7eb1c029b7fec45a7f22e
SHA1 8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256 c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA512 0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

MD5 038bf9f3a58560ad1130eeb85cdc1a87
SHA1 3571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256 d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA512 8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

MD5 4570f7a40357016c97afe0dd4faf749b
SHA1 ebc8a1660f1103c655559caab3a70ec23ca187f1
SHA256 a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8
SHA512 6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

MD5 292a1748850d1fdc91d4ec23b02d6902
SHA1 8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256 acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512 cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

MD5 3d0b27b3f8aa22575aa0faf0b2d67216
SHA1 39fc787538849692ed7352418616f467b7a86a1d
SHA256 d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44
SHA512 19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

MD5 2ddfa39f5c2fd3f00681ef2970617e4b
SHA1 8152aa18afbacf398b92168995ec8696d3fe3659
SHA256 f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512 f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

MD5 e44e34bc285b709f08f967325d9c8be1
SHA1 e73f05c6a980ec9d006930c5343955f89579b409
SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

MD5 bc25377ade68750b834c81fa71c233b8
SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

memory/2176-181-0x0000000000000000-mapping.dmp

memory/2520-182-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Users\Admin\AppData\Local\Temp\killself.bat

MD5 c2ac85b000427a4a00f19da237aaaf86
SHA1 459ecb5e64576348e6c654724e87825772c06ea8
SHA256 b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352
SHA512 e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b

memory/2176-186-0x0000000002700000-0x0000000002701000-memory.dmp

memory/2520-187-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/2168-188-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

memory/2168-190-0x0000000000B20000-0x0000000000B21000-memory.dmp