ramnit | 280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe
Size

7.5MB
MD5

ba351f8b5c47b70eee91328f2bc2345b
SHA1

94b4eb2cbab81d9d6b2883bf96ade2cebc3157cb
SHA256

280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667
SHA512

2a80ce863e5a037d58d618a6da9ef17a1dab86f23191348e49e4985999d3fc86cb30d3ec123d43654a4637e2ec53c21204df8141768945c206806a4f1ccf5bb6
SSDEEP

196608:3XnJBzfmUJZhtsZythv8GLvm0ITvrLU/defgZE:3XnTDxr3D6jLU/w9

Score

10^/10

ramnit rms banker rat spyware stealer trojan upx worm

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	3140	msiexec.exe
8	3140	msiexec.exe
10	3140	msiexec.exe

Executes dropped EXE 19 IoCs

pid	Process
3132	rutserv.exe
1376	rutservSrv.exe
708	DesktopLayer.exe
4720	rutserv.exe
3368	rutservSrv.exe
2396	DesktopLayer.exe
5096	rutserv.exe
4352	rutservSrv.exe
1836	DesktopLayer.exe
1980	rutserv.exe
3220	rutservSrv.exe
3208	DesktopLayer.exe
3124	rfusclient.exe
4668	rfusclient.exe
4304	rfusclientSrv.exe
4552	DesktopLayer.exe
6096	rfusclient.exe
6176	rfusclientSrv.exe
6320	DesktopLayer.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1376-151-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1376-154-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/708-158-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4304-222-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe

Loads dropped DLL 8 IoCs

pid	Process
4592	MsiExec.exe
3132	rutserv.exe
4720	rutserv.exe
5096	rutserv.exe
1980	rutserv.exe
3124	rfusclient.exe
4668	rfusclient.exe
6096	rfusclient.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\55ef2e89-3793-4521-a697-d33ae4f85ef0.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{37117216-5727-11ED-A0EE-426B8B52D88D}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.2	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\2dec0c3b-2305-44c0-9c79-6cce0843f3e9.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\data_1	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\3b4a8cea-1535-4ccb-96c8-9552614de2d2.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\54a849d0-a138-4076-81d7-98b1f81d56fe.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\11c68a60-034b-459e-89c2-3af132d0dcff.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Virtualized	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe575340.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\2dec0c3b-2305-44c0-9c79-6cce0843f3e9.tmp	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxC77B.tmp	rutservSrv.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	attrib.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxCD19.tmp	rutservSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px3AF6.tmp	rfusclientSrv.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rutservSrv.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll	attrib.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e56b635.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF8D.tmp	msiexec.exe
File created	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD0B.tmp	msiexec.exe
File created	C:\Windows\Installer\e56b638.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\28122008.txt	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e56b635.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D3BB12F-9903-4D4A-A062-97947D2AB44E}	msiexec.exe
File created	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File created	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "212793977"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373771122"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "264667614"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{371FC14F-5727-11ED-A0EE-426B8B52D88D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993204"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993204"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "199355786"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "199355786"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\ProgId = "MSEdgeHTM"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 89be75672cbed801	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEMigration	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ie_to_edge_stub.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{257757D9-5727-11ED-A0EE-426B8B52D88D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@ieframe.dll,-12512 = "Bing"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ie_to_edge_stub.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\ihmafllikibpmigkcoadcmckbfhibefp = "C446D23488FB697DB203700461A5EDC6F51C0EEA5110DE63564D0694CB99413F"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{C89E2069-AF13-46DB-9E39-216131494B87}	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEToEdge\UpsellDisabled = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\UsageStatsInSample = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{C89E2069-AF13-46DB-9E39-216131494B87}\DeviceId = "0018000AA3474A5F"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeMHT_.mht = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenPuaEnabled	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Type = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ie_to_edge_stub.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{C89E2069-AF13-46DB-9E39-216131494B87}\DeviceId = "0018000AA3474A5F"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e6070a0006001d0001000f002f001201	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenPuaEnabled	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{C89E2069-AF13-46DB-9E39-216131494B87}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000df8392f1596b5f44868027ccd458bdc900000000020000000000106600000001000020000000c7409516a1ba550fdded427891f83ac94cf667cce76833a1ef3e2a2611e136c9000000000e80000000020000200000002e69e9d0a3aee5110d277e3903f46c8838e35873a9057ec12ed64acdd106e9f5d003000046bc6a062b41ef133e80c15b55b6fecee1d1858e155ed4ec01d1c0b42cc43001058d78f4b422523e01185ad8c21a6081b0a26c694fc8af77486f1d87572f7d530ee81a774b0d4582909d3435a6ae279bd2f6f52e9d26b980e63c76166cb8af42975444d42aeb57f2522180b56f59065cf4dfc32ea767aad5588dbf9f892d450eb11ff9c98a5c173abe5f7d0fe6d063fb413ff46e9db27ea97983b5a791f01a101e60e9244709d1be247ff5096684eaa42d69f31a67c9a06c2de1401e18f20513d45905d20806686ae40cecfa918c7cad8cafa5adff02e02c3ff53d0f0054d7cf1532cb6a390a4bc16307117edd3cf182a108909bc1bc76170063c21a771d5804ddd7855aee98eae042792a5ccad1f50cd0b52d671e9194078f7ee9167804a153e0cef14ad6a6e47fd040a50fb2cdb66e0fd32d316828b08d7ee41156c3792248d0ec023ae2bfc421b11d81403fd4eacad41b9b5950d687836bbf6c258544d3551f10409b1a33839b2e8d021295feac13f251a64704f1250591e541fc8af05ed02bffa11c24bee62d217d0234a3c2662923ce7d8781184498e3a9b2164a7953219d742106f4680cf9a0a746325d56b4f8e0ccf1e3a8a0c6caea0504000ac42de42b2a0504c47403c4f1b202065e6fdd8fdc228ba33de73e02405dbce274164607415593ac4f069920a21ed02f87d3c8adc8d579887a8975637ab816ab5e2fbc54e31ba5351fe4a6d0b3c5fd084d876f6101cdfeee51a312c487ccdab1fe29411851cf7339550966d18ecbf2f464032465cb8510db710e4c395bfaf5ce15d1d835b12068eef47905ef1754370695a9257903b794c8b2ba04fcf85c038d3b94402dfb4534ad80bdb4893fde21ec4f51b7e20a1cb8a9db253cb49d13735740b75e226471c747b8c07752dcc9339b95b68abf626b852eb1522ecc16754ebb0a4694932b121a84e2848a95bc8349873e350f4dfb68df205cf9f9d4ab2d6707780126df97c16ca8039089a4b0e87dc5d508bd92091bad8443ddfc134ed761e88e0ad3f0791141fc71ea4d0f3dd30642716608bc3afd767293a9ef498381220c06941c12e423a03af003a2f5c15e0df8bdf9f1e9898a58994466db000afd0ff0182ec8ca4825bf74f080b64e9648fbea77a17c82c877f01a5fe19bc50ef446cb5c80aa0476d0a28733bc70e72e7ea0783265d04e11889a78ced4d87a092a54252980a607c5b1ad49bfca23f536d5fcb064954eb722a9fca015e9c55fbb1493ad03a431c64f86b4bc8417e64749b7f86e820301aa7504cf8068f41c3b0d5c664b7c3ef4f3d5427d0cd211f07688e10e150961ac82b03a146a9f68767296beb9da9f179a10afbf64855d743370bda196057ec1622940000000c992e1d17ec0882a36ab27cd55a23618119bded9d7106ad991f46513e67cdb6fa9680612b477c62063739e26fde84dc7387d43117c7b30e2981042c1dce79014	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids	setup.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\F21BB3D03099A4D40A267949D7A24BE4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Language = "1049"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\ProductIcon = "C:\\Windows\\Installer\\{0D3BB12F-9903-4D4A-A062-97947D2AB44E}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductName	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\1 = "DISK1;1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\DeploymentFlags = "3"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\PackageCode = "001E4BCEB6F30B0418BA0CB49940D551"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\PackageName = "rms.host5.6ru.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\PackageCode = "CA621BAB2625C4F47B0824566FC192D8"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AuthorizedLUAApp = "0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F21BB3D03099A4D40A267949D7A24BE4\RMS	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Clients = 3a0000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\LastUsedSource = "n;1;C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F21BB3D03099A4D40A267949D7A24BE4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\DiskPrompt = "[1]"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net\1 = "C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductIcon = "C:\\Windows\\Installer\\{C2AD926E-45DC-4C5F-88A0-63AEE6A3262A}\\ARPPRODUCTICON.exe"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Assignment = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AdvertiseFlags = "388"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\PackageName = "rms.host5.5ru.msi"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Version = "100603060"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\InstanceType = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F21BB3D03099A4D40A267949D7A24BE4\Version = "100603766"	msiexec.exe

Runs .reg file with regedit 1 IoCs

pid	Process
6712	regedit.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1520	PING.EXE
4984	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	msiexec.exe
3140	msiexec.exe
3132	rutserv.exe
3132	rutserv.exe
3132	rutserv.exe
3132	rutserv.exe
3132	rutserv.exe
3132	rutserv.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
708	DesktopLayer.exe
4720	rutserv.exe
4720	rutserv.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
2396	DesktopLayer.exe
5096	rutserv.exe
5096	rutserv.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1836	DesktopLayer.exe
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
1980	rutserv.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
3208	DesktopLayer.exe
4668	rfusclient.exe
4668	rfusclient.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
4552	DesktopLayer.exe
5224	msedge.exe
5224	msedge.exe
5252	msedge.exe
5252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
6096	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	3140	msiexec.exe
Token: SeCreateTokenPrivilege	1504	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1504	msiexec.exe
Token: SeLockMemoryPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeMachineAccountPrivilege	1504	msiexec.exe
Token: SeTcbPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	1504	msiexec.exe
Token: SeTakeOwnershipPrivilege	1504	msiexec.exe
Token: SeLoadDriverPrivilege	1504	msiexec.exe
Token: SeSystemProfilePrivilege	1504	msiexec.exe
Token: SeSystemtimePrivilege	1504	msiexec.exe
Token: SeProfSingleProcessPrivilege	1504	msiexec.exe
Token: SeIncBasePriorityPrivilege	1504	msiexec.exe
Token: SeCreatePagefilePrivilege	1504	msiexec.exe
Token: SeCreatePermanentPrivilege	1504	msiexec.exe
Token: SeBackupPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1504	msiexec.exe
Token: SeAuditPrivilege	1504	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1504	msiexec.exe
Token: SeChangeNotifyPrivilege	1504	msiexec.exe
Token: SeRemoteShutdownPrivilege	1504	msiexec.exe
Token: SeUndockPrivilege	1504	msiexec.exe
Token: SeSyncAgentPrivilege	1504	msiexec.exe
Token: SeEnableDelegationPrivilege	1504	msiexec.exe
Token: SeManageVolumePrivilege	1504	msiexec.exe
Token: SeImpersonatePrivilege	1504	msiexec.exe
Token: SeCreateGlobalPrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1608	msiexec.exe
Token: SeCreateTokenPrivilege	1608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1608	msiexec.exe
Token: SeLockMemoryPrivilege	1608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1608	msiexec.exe
Token: SeMachineAccountPrivilege	1608	msiexec.exe
Token: SeTcbPrivilege	1608	msiexec.exe
Token: SeSecurityPrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeLoadDriverPrivilege	1608	msiexec.exe
Token: SeSystemProfilePrivilege	1608	msiexec.exe
Token: SeSystemtimePrivilege	1608	msiexec.exe
Token: SeProfSingleProcessPrivilege	1608	msiexec.exe
Token: SeIncBasePriorityPrivilege	1608	msiexec.exe
Token: SeCreatePagefilePrivilege	1608	msiexec.exe
Token: SeCreatePermanentPrivilege	1608	msiexec.exe
Token: SeBackupPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeShutdownPrivilege	1608	msiexec.exe
Token: SeDebugPrivilege	1608	msiexec.exe
Token: SeAuditPrivilege	1608	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1608	msiexec.exe
Token: SeChangeNotifyPrivilege	1608	msiexec.exe
Token: SeRemoteShutdownPrivilege	1608	msiexec.exe
Token: SeUndockPrivilege	1608	msiexec.exe
Token: SeSyncAgentPrivilege	1608	msiexec.exe
Token: SeEnableDelegationPrivilege	1608	msiexec.exe
Token: SeManageVolumePrivilege	1608	msiexec.exe
Token: SeImpersonatePrivilege	1608	msiexec.exe
Token: SeCreateGlobalPrivilege	1608	msiexec.exe
Token: SeShutdownPrivilege	220	msiexec.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
4696	iexplore.exe
2140	iexplore.exe
2348	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
4404	iexplore.exe
3660	msedge.exe
4404	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4696	iexplore.exe
4696	iexplore.exe
2140	iexplore.exe
2140	iexplore.exe
4632	IEXPLORE.EXE
4632	IEXPLORE.EXE
4148	IEXPLORE.EXE
4148	IEXPLORE.EXE
2348	iexplore.exe
2348	iexplore.exe
2120	iexplore.exe
2120	iexplore.exe
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4404	iexplore.exe
4404	iexplore.exe
4248	IEXPLORE.EXE
4248	IEXPLORE.EXE
332	IEXPLORE.EXE
332	IEXPLORE.EXE
4404	iexplore.exe
4404	iexplore.exe
6516	IEXPLORE.EXE
6516	IEXPLORE.EXE
6516	IEXPLORE.EXE
6516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 580	992	280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe	84
PID 992 wrote to memory of 580	992	280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe	84
PID 992 wrote to memory of 580	992	280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe	84
PID 580 wrote to memory of 1504	580	cmd.exe	86
PID 580 wrote to memory of 1504	580	cmd.exe	86
PID 580 wrote to memory of 1504	580	cmd.exe	86
PID 580 wrote to memory of 1608	580	cmd.exe	88
PID 580 wrote to memory of 1608	580	cmd.exe	88
PID 580 wrote to memory of 1608	580	cmd.exe	88
PID 580 wrote to memory of 1520	580	cmd.exe	89
PID 580 wrote to memory of 1520	580	cmd.exe	89
PID 580 wrote to memory of 1520	580	cmd.exe	89
PID 580 wrote to memory of 220	580	cmd.exe	90
PID 580 wrote to memory of 220	580	cmd.exe	90
PID 580 wrote to memory of 220	580	cmd.exe	90
PID 3140 wrote to memory of 4592	3140	msiexec.exe	92
PID 3140 wrote to memory of 4592	3140	msiexec.exe	92
PID 3140 wrote to memory of 4592	3140	msiexec.exe	92
PID 3140 wrote to memory of 3132	3140	msiexec.exe	93
PID 3140 wrote to memory of 3132	3140	msiexec.exe	93
PID 3140 wrote to memory of 3132	3140	msiexec.exe	93
PID 3132 wrote to memory of 1376	3132	rutserv.exe	94
PID 3132 wrote to memory of 1376	3132	rutserv.exe	94
PID 3132 wrote to memory of 1376	3132	rutserv.exe	94
PID 1376 wrote to memory of 708	1376	rutservSrv.exe	95
PID 1376 wrote to memory of 708	1376	rutservSrv.exe	95
PID 1376 wrote to memory of 708	1376	rutservSrv.exe	95
PID 708 wrote to memory of 4696	708	DesktopLayer.exe	96
PID 708 wrote to memory of 4696	708	DesktopLayer.exe	96
PID 3140 wrote to memory of 4720	3140	msiexec.exe	97
PID 3140 wrote to memory of 4720	3140	msiexec.exe	97
PID 3140 wrote to memory of 4720	3140	msiexec.exe	97
PID 4720 wrote to memory of 3368	4720	rutserv.exe	98
PID 4720 wrote to memory of 3368	4720	rutserv.exe	98
PID 4720 wrote to memory of 3368	4720	rutserv.exe	98
PID 4696 wrote to memory of 4632	4696	iexplore.exe	99
PID 4696 wrote to memory of 4632	4696	iexplore.exe	99
PID 4696 wrote to memory of 4632	4696	iexplore.exe	99
PID 3368 wrote to memory of 2396	3368	rutservSrv.exe	100
PID 3368 wrote to memory of 2396	3368	rutservSrv.exe	100
PID 3368 wrote to memory of 2396	3368	rutservSrv.exe	100
PID 2396 wrote to memory of 2140	2396	DesktopLayer.exe	101
PID 2396 wrote to memory of 2140	2396	DesktopLayer.exe	101
PID 3140 wrote to memory of 5096	3140	msiexec.exe	102
PID 3140 wrote to memory of 5096	3140	msiexec.exe	102
PID 3140 wrote to memory of 5096	3140	msiexec.exe	102
PID 2140 wrote to memory of 4148	2140	iexplore.exe	103
PID 2140 wrote to memory of 4148	2140	iexplore.exe	103
PID 2140 wrote to memory of 4148	2140	iexplore.exe	103
PID 5096 wrote to memory of 4352	5096	rutserv.exe	104
PID 5096 wrote to memory of 4352	5096	rutserv.exe	104
PID 5096 wrote to memory of 4352	5096	rutserv.exe	104
PID 4352 wrote to memory of 1836	4352	rutservSrv.exe	105
PID 4352 wrote to memory of 1836	4352	rutservSrv.exe	105
PID 4352 wrote to memory of 1836	4352	rutservSrv.exe	105
PID 1836 wrote to memory of 2348	1836	DesktopLayer.exe	106
PID 1836 wrote to memory of 2348	1836	DesktopLayer.exe	106
PID 580 wrote to memory of 4984	580	cmd.exe	109
PID 580 wrote to memory of 4984	580	cmd.exe	109
PID 580 wrote to memory of 4984	580	cmd.exe	109
PID 1980 wrote to memory of 3220	1980	rutserv.exe	108
PID 1980 wrote to memory of 3220	1980	rutserv.exe	108
PID 1980 wrote to memory of 3220	1980	rutserv.exe	108
PID 4632 wrote to memory of 3816	4632	IEXPLORE.EXE	110

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
6932	attrib.exe
6996	attrib.exe
7044	attrib.exe
7092	attrib.exe

C:\Users\Admin\AppData\Local\Temp\280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe
"C:\Users\Admin\AppData\Local\Temp\280e875558885b3a82fc5c4a4f0d25c16f6ab412c9d855053ca2bceb38b5a667.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {54067864-C0E7-47DB-A0C1-D6C874CE6BD8} /qn REBOOT=ReallySuppress
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1520
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "rms.host5.6ru.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4984
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s 28.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:6712
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r "C:\Program Files (x86)\Remote Manipulator System - Host"
    3⤵
    - Views/modifies file attributes
    PID:6932
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r "C:\Program Files (x86)\Remote Manipulator System - Host"
    3⤵
    - Views/modifies file attributes
    PID:6996
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r /d /s "C:\Program Files (x86)\Remote Manipulator System - Host\*.*"
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:7044
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r /d /s "C:\Program Files (x86)\Remote Manipulator System - Host\*.*"
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:7092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BD011AF8C7FB055D075D5159336789C2
  2⤵
  - Loads dropped DLL
  PID:4592
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4696
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4696 CREDAT:17410 /prefetch:2
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40172
        7⤵
        Modifies data under HKEY_USERS
        
        PID:3816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40172
        8⤵
        Modifies data under HKEY_USERS
        
        PID:4264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd51d246f8,0x7ffd51d24708,0x7ffd51d24718
        9⤵
        
        PID:744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8251745796901291702,9452137748472434810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        9⤵
        
        PID:464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8251745796901291702,9452137748472434810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5224
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:17410 /prefetch:2
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10216
        7⤵
        
        PID:4060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10216
        8⤵
        Modifies data under HKEY_USERS
        
        PID:3916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd51d246f8,0x7ffd51d24708,0x7ffd51d24718
        9⤵
        
        PID:3440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5115513362606643782,2009425382824007315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        9⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5115513362606643782,2009425382824007315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
        9⤵
        
        PID:5236
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies data under HKEY_USERS
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:17410 /prefetch:2
        6⤵
        Modifies data under HKEY_USERS
        Suspicious use of SetWindowsHookEx
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10294
        7⤵
        Modifies data under HKEY_USERS
        
        PID:3712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10294
        8⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd51d246f8,0x7ffd51d24708,0x7ffd51d24718
        9⤵
        
        PID:1984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1724668109769822645,16441654062312856650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        9⤵
        
        PID:5128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,1724668109769822645,16441654062312856650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,1724668109769822645,16441654062312856650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
        9⤵
        
        PID:5376

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe"
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3208
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3124
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4304
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4552
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: SetClipboardViewer
    PID:6096
  - - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe
      "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe"
      4⤵
      Executes dropped EXE
      PID:6176
    - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        5⤵
        Executes dropped EXE
        
        PID:6320
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        
        PID:6460

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:17410 /prefetch:2
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40026
    3⤵
    - Modifies data under HKEY_USERS
    PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40026
      4⤵
      Drops file in System32 directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:4348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd51d246f8,0x7ffd51d24708,0x7ffd51d24718
        5⤵
        Drops file in System32 directory
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        5⤵
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
        5⤵
        Modifies data under HKEY_USERS
        
        PID:5848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        Drops file in System32 directory
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        
        PID:6072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
        5⤵
        
        PID:5656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:6188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:6296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,121645112192007466,11850291706613098859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
        5⤵
        
        PID:236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Modifies data under HKEY_USERS
        
        PID:3364
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff777a65460,0x7ff777a65470,0x7ff777a65480
        6⤵
        
        PID:6840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4404 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4404 CREDAT:17414 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:6516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
43KB

MD5
fcccdb05b62796ad70eec5b21069114a

SHA1
e9aeb1bb63ed3c23e15c033049a9a645f6e2f1fa

SHA256
e4e1e61c81fe036cd05c2ed1a362e1f20565cf6df29fd714b7ad145e1b5176ce

SHA512
a187ee14092dabe948944bd9c451364cb48a08bdff044756f1281d7fba3398a926bb5260b66422dad78d2557791d3187a8e9f76d11a8f5382886393adb987cc8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
144KB

MD5
941d1b63a94549cbe5224a4e722dd4d5

SHA1
bab121f4c3528af35456bac20fbd296112624260

SHA256
ce1cd24a782932e1c28c030da741a21729a3c5930d8358079b0f91747dd0d832

SHA512
b6bf11fa34ceab70e3f3ce48a8a6dcbe5cfa859db4a03ca18cc6309773a32aff9db111d2d2ab5bb1ce974322eaf71ea81cfaa3911d6b8085a82823a0aa1d30ee

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
957KB

MD5
897266223a905afdc1225ff4e621c868

SHA1
6a5130154430284997dc76af8b145ab90b562110

SHA256
be991f825a2e6939f776ebc6d80d512a33cbbe60de2fcc32820c64f1d6b13c07

SHA512
1ad1386e71e036e66f3b6fdece5a376e7309ceb0f6eb73c3a8203b0825c45aa1f74e1f722b508cf3f73456e7d808853d37bcef79bfe8476fc16a4e6af2e9202b

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
48KB

MD5
50716fb95abf80ff78451e8a33f16d3c

SHA1
25552c03bf9ab4eb475ba9880a25acd09d44c4f5

SHA256
c36482a3a77859c8c7856da7c1360cfb6b84112df08c50cb3ec176546fa3fa1c

SHA512
071c131826e1d76b79e1dfbf5f1934d4ad5c49cbd904b13e7b11706fc3dd16db281d8ca32f49d08a3640ce59caec2a74597534607701606a7dc52ddf424742e2

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll

Filesize
240KB

MD5
50bad879226bcbbf02d5cf2dcbcfbf61

SHA1
be262f40212bd5a227d19fdbbd4580c200c31e4b

SHA256
49295f414c5405a4f180b319cfed471871471776e4853baaf117a5185ec0d90d

SHA512
476df817a9c9e23423080afcac899b83fc8f532e4fe62bea2feeb988cba538f1f710e2fb61d81d6c283c428d772922c7a6ecb1684ac68ca8f267415105a60116

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
2721aa44e21659358e8a25c0f13ce02b

SHA1
91589226e6fd81675e013c5b7aad06e5f7903e61

SHA256
74ca24097bc69145af11dc6a0580665d4766aa78c7633f4084d16d7b4fecc5fb

SHA512
fb1f06e18b369e5df0dedf20bf5bcaae4f6d93bf8a4789db2d05b7c895fdeff2dc086089cca67fa7d352563b491606a547c37959db623b071e90a1c876d6cc2a

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll

Filesize
1.6MB

MD5
7916c52814b561215c01795bb71bb884

SHA1
0b3341642559efc8233561f81ec80a3983b9fc2d

SHA256
7d3c4c52684afff597dc4c132c464b651cb94aad039458b674d69cf76c240e64

SHA512
fc0a1d717c636639be6835d93bdde8019799842e11a055bedeb468f57cfaabf5582a65e1770841486550e06b1b9ba020ff5fad14b7838fe70afefb37933f1a8f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll

Filesize
556KB

MD5
99c5cb416cb1f25f24a83623ed6a6a09

SHA1
0dbf63dea76be72390c0397cb047a83914e0f7c8

SHA256
9f47416ca37a864a31d3dc997677f8739433f294e83d0621c48eb9093c2e4515

SHA512
8bd1b14a690aa15c07ead90edacbcc4e8e3f68e0bfd6191d42519b9542786df35a66ed37e7af9cf9ff14d55a5622c29a88fee2a5bde889740a3ce6160d5256ac

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll

Filesize
638KB

MD5
bfeac23ced1f4ac8254b5cd1a2bf4dda

SHA1
fd450e3bc758d984f68f0ae5963809d7d80645b6

SHA256
420d298de132941eacec6718039a5f42eaec498399c482e2e0ff4dad76a09608

SHA512
1f4afc2eb72f51b9e600fbbf0d4408728e29b0c6ca45801605801ead0a287873ebbfaaae10b027f1a287c82232d1e7a3a7e7435b7f6a39223c3f7b23d96ed272

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
4.8MB

MD5
8ae7c08d0c3805092e59cd384da8b618

SHA1
d1e443a5226621e7d2ca48660d68985933ff8659

SHA256
03cccc0222706488a7da919bb6298067ba5e9ef854ecf8d1dc45ffadd392841c

SHA512
1b96509721d9606d1c6c00c385ee5136218ea683c038a666fc903cf13d26874b3ccd1891f627f65e765a74a5987d40ea6725fbf87e954a812638edfb59b3f1f7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
4.8MB

MD5
8ae7c08d0c3805092e59cd384da8b618

SHA1
d1e443a5226621e7d2ca48660d68985933ff8659

SHA256
03cccc0222706488a7da919bb6298067ba5e9ef854ecf8d1dc45ffadd392841c

SHA512
1b96509721d9606d1c6c00c385ee5136218ea683c038a666fc903cf13d26874b3ccd1891f627f65e765a74a5987d40ea6725fbf87e954a812638edfb59b3f1f7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
4.8MB

MD5
8ae7c08d0c3805092e59cd384da8b618

SHA1
d1e443a5226621e7d2ca48660d68985933ff8659

SHA256
03cccc0222706488a7da919bb6298067ba5e9ef854ecf8d1dc45ffadd392841c

SHA512
1b96509721d9606d1c6c00c385ee5136218ea683c038a666fc903cf13d26874b3ccd1891f627f65e765a74a5987d40ea6725fbf87e954a812638edfb59b3f1f7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclientSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.8MB

MD5
ae0f362b2afc356560b498e665289dc2

SHA1
c4adc720f015715ea17fee1935ade4af2fb503ab

SHA256
57ae1d78909fede3aa45037bfb5402204c13b162d85f553448f2767bb8ceb397

SHA512
8c96b1fa69e4d5e6776bee99c1a66f66ab91a9c5c06008587000b3666df83c4cb54400f39908ff344b19159bd48d44c0078717d7e13eb825bd58587a23295699

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.8MB

MD5
ae0f362b2afc356560b498e665289dc2

SHA1
c4adc720f015715ea17fee1935ade4af2fb503ab

SHA256
57ae1d78909fede3aa45037bfb5402204c13b162d85f553448f2767bb8ceb397

SHA512
8c96b1fa69e4d5e6776bee99c1a66f66ab91a9c5c06008587000b3666df83c4cb54400f39908ff344b19159bd48d44c0078717d7e13eb825bd58587a23295699

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.8MB

MD5
ae0f362b2afc356560b498e665289dc2

SHA1
c4adc720f015715ea17fee1935ade4af2fb503ab

SHA256
57ae1d78909fede3aa45037bfb5402204c13b162d85f553448f2767bb8ceb397

SHA512
8c96b1fa69e4d5e6776bee99c1a66f66ab91a9c5c06008587000b3666df83c4cb54400f39908ff344b19159bd48d44c0078717d7e13eb825bd58587a23295699

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.8MB

MD5
ae0f362b2afc356560b498e665289dc2

SHA1
c4adc720f015715ea17fee1935ade4af2fb503ab

SHA256
57ae1d78909fede3aa45037bfb5402204c13b162d85f553448f2767bb8ceb397

SHA512
8c96b1fa69e4d5e6776bee99c1a66f66ab91a9c5c06008587000b3666df83c4cb54400f39908ff344b19159bd48d44c0078717d7e13eb825bd58587a23295699

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.8MB

MD5
ae0f362b2afc356560b498e665289dc2

SHA1
c4adc720f015715ea17fee1935ade4af2fb503ab

SHA256
57ae1d78909fede3aa45037bfb5402204c13b162d85f553448f2767bb8ceb397

SHA512
8c96b1fa69e4d5e6776bee99c1a66f66ab91a9c5c06008587000b3666df83c4cb54400f39908ff344b19159bd48d44c0078717d7e13eb825bd58587a23295699

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutservSrv.exe

Filesize
52KB

MD5
17efb7e40d4cadaf3a4369435a8772ec

SHA1
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

SHA256
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386

SHA512
522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
409KB

MD5
1525887bc6978c0b54fec544877319e6

SHA1
7820fcd66e6fbf717d78a2a4df5b0367923dc431

SHA256
a47431090c357c00b27a3327d9d591088bc84b60060751ea6454cb3f1ae23e69

SHA512
56cb35ef2d5a52ba5cf4769a6bad4a4bae292bceff1b8aff5125046d43aff7683282a14bc8b626d7dccc250e0ed57b1ae54dd105732573089359444f774d6153

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
691KB

MD5
c8fd8c4bc131d59606b08920b2fda91c

SHA1
df777e7c6c1b3d84a8277e6a669e9a5f7c15896d

SHA256
6f5ddf4113e92bf798e9ecf0fc0350ee7cae7c5479ca495e3045bdb313efd240

SHA512
2fe25325a94cd0f8af30f96ef03c4e64b1a721f603f792d9da72dcd4a5c92081bb24d90da5394f47e54d9d23e9c7ee845cbf469ea8371c088bda787c54b9369d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1dde831b3f72227121241cfbcf0b8bfa

SHA1
e076ca61127cce19e3495b3a0ae3dfdb8592effd

SHA256
b3f388e535f4220252e0b0b4fc8146c51489ecbeca74227f8cdff78ed0062cc6

SHA512
2ec5a389bb710a725b75ba3e27f3fbcb0d5d6bd2ff0803d1f2381d1a79c7162581c6818afaa7e10aa03900482e2a1f683ca8cb7ed2f68489efa093715740f03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1dde831b3f72227121241cfbcf0b8bfa

SHA1
e076ca61127cce19e3495b3a0ae3dfdb8592effd

SHA256
b3f388e535f4220252e0b0b4fc8146c51489ecbeca74227f8cdff78ed0062cc6

SHA512
2ec5a389bb710a725b75ba3e27f3fbcb0d5d6bd2ff0803d1f2381d1a79c7162581c6818afaa7e10aa03900482e2a1f683ca8cb7ed2f68489efa093715740f03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1dde831b3f72227121241cfbcf0b8bfa

SHA1
e076ca61127cce19e3495b3a0ae3dfdb8592effd

SHA256
b3f388e535f4220252e0b0b4fc8146c51489ecbeca74227f8cdff78ed0062cc6

SHA512
2ec5a389bb710a725b75ba3e27f3fbcb0d5d6bd2ff0803d1f2381d1a79c7162581c6818afaa7e10aa03900482e2a1f683ca8cb7ed2f68489efa093715740f03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1dde831b3f72227121241cfbcf0b8bfa

SHA1
e076ca61127cce19e3495b3a0ae3dfdb8592effd

SHA256
b3f388e535f4220252e0b0b4fc8146c51489ecbeca74227f8cdff78ed0062cc6

SHA512
2ec5a389bb710a725b75ba3e27f3fbcb0d5d6bd2ff0803d1f2381d1a79c7162581c6818afaa7e10aa03900482e2a1f683ca8cb7ed2f68489efa093715740f03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1aa7e0f203b5b0b2f753567d77fbe2d9

SHA1
443937fd906e3a356a6689181b29a9e849f54209

SHA256
27f1577aa081b2222b6549e74de58ef60bf0a054c7b2a345366e6ebbf44fab8c

SHA512
ce2fff1ddfab2e82f4e8ec6b3d04405f9fb2ad07dccfdde404411de9bbc66033610ad1689316173878be9758bb822612d4a931901e1ed4bbbd41199c2885debf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{24EAAAB5-5727-11ED-A0EE-426B8B52D88D}.dat

Filesize
5KB

MD5
e9b1d2c3563008209d47f1a4173a7246

SHA1
8cf34ea397e9f12bc7004e4f771708f39348d6f9

SHA256
1085309c2e0084ba2ddba37dd0e4663852d0dbef8dadfe9ff29e488aa8550cee

SHA512
9865f3647b0c817e15d31edac0eb9c048fd8c0ea657ddf97aeec1eaf5f72e1b6c00fb2866fa6d4b8cdfb5328bd7ace15ab3ef64cfafc1307c956e54704d2ca19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{257757D9-5727-11ED-A0EE-426B8B52D88D}.dat

Filesize
5KB

MD5
7286017b0a037f41d79fa6f091a1bc06

SHA1
79fca5ce5923d15cb05a3fae149e44cfb41b0060

SHA256
42b9038c7add6322dcf981d7f3c52b6aa720c1a2b9590c874c9a353c103d9595

SHA512
2af7ab28df5e5ba5cf15b45453c8b91ff377c0eaf0c2fe060c6013292f9940f878e068deacfa94fe49c141cae737b20601c197a3934580fe29f6dccf986120cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
823B

MD5
84b1a5a529c1fcefce2b4ab1c84c90cb

SHA1
a00ea7622732b573000909eabb3981a435e61588

SHA256
c7e3f98061ce60f99799e94241b2b105dffcfdc08ff5bc02550167b049106578

SHA512
8dc813d35abc96975338dab09b93c62d3c81bdaf8a626b858eac7e6cd779d02393e92dda11b7e9a52a3806742979e28399060673f855022739077cf73aeb92fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host5.6ru.msi

Filesize
8.0MB

MD5
7ad38910c716726ff54d2f9bd5185d5d

SHA1
d513f87b8415f893dc0a68a4630f991d077bc400

SHA256
6504cf10b0b2f9df759cbd6eb5fc15e481bf17d7dbecb3241c4d8e9b852a0575

SHA512
11c959e453d47a1aade6841d912d5bde831b804175b036695150856f03d064e0cc111ccd4a9f98a38cae19c48229b3e9e26dbcc0b9e337d463aa222f925a0d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\winmm.dll

Filesize
75KB

MD5
8015ab2cc394e54e4a36a0bad7027768

SHA1
1c15df81fdcace56f59bd45911f0bc9e37ed521f

SHA256
8b82c3b3b26aee27b8cf5bdfb6e947a0cdcab7e6015f786f4df851d9c2eec42c

SHA512
9fe2c5588e429d2887b7a16427110e32c579140906d68665c19cc8bc3738fa7ac596ac49974e8426877d1154101ed83e6685485a2531c3ffe5bc61c581be20e8

Download Submit
C:\Windows\Installer\MSIBD0B.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\Installer\MSIBD0B.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a27d5512ebd8d1bd4c4996f82d8ff5e1

SHA1
e4200638d1fef60ad06e6a31acbe0c1039dcab12

SHA256
8ee4c3b6be53a3fb04361ff09ff090829c1e5cc779203b3a6233117ca398181e

SHA512
55bb3c6eece2c688dd2889a0e78b491414214cd19d78746d82151c1dac2a1f1ce308ba13d8dd9dd30ee6bc870365cc82eceae298ee22aef314097f5294f3f786

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
memory/708-158-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1376-154-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1376-151-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1980-210-0x0000000073350000-0x0000000073365000-memory.dmp

Filesize
84KB

Download
memory/3124-226-0x0000000073350000-0x0000000073365000-memory.dmp

Filesize
84KB

Download
memory/3132-157-0x00000000733E0000-0x00000000733F5000-memory.dmp

Filesize
84KB

Download
memory/4304-222-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4668-227-0x0000000073350000-0x0000000073365000-memory.dmp

Filesize
84KB

Download
memory/4720-170-0x00000000733E0000-0x00000000733F5000-memory.dmp

Filesize
84KB

Download
memory/5096-182-0x0000000073350000-0x0000000073365000-memory.dmp

Filesize
84KB

Download
memory/6096-278-0x0000000073350000-0x0000000073365000-memory.dmp

Filesize
84KB

Download