rms | b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe
Size

6.4MB
MD5

eaa15cfa6df1f8ff32d5fa6024922d6f
SHA1

d8f2fc4ec0bcd3f3a4b7ea644b5214fa8dd7f42e
SHA256

b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7
SHA512

86a3c617eded125e2f437245e585452374077916d3d2b552a033331e0fc16e99ac59ee370fb4c15d37e948119a2573a98a1fa184909794cc47d525aad03c0ba7
SSDEEP

196608:NM7/ZBDE9DfH2yVpFofWqPmWInEZyxoTL2s6kL:NmW9DuyVpFoPZyxoHIa

Score

10^/10

rms discovery rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 7 IoCs

pid	Process
4436	rutserv.exe
1984	rutserv.exe
3096	rutserv.exe
1036	rutserv.exe
4084	rfusclient.exe
3076	rfusclient.exe
4756	rfusclient.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe

Loads dropped DLL 8 IoCs

pid	Process
2108	MsiExec.exe
4436	rutserv.exe
1984	rutserv.exe
3096	rutserv.exe
1036	rutserv.exe
3076	rfusclient.exe
4084	rfusclient.exe
4756	rfusclient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\webmvorbisdecoder.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\install.cmd	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unires_vpd.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Logs	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\progress.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\EULA.rtf	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RIPCServer.dll	rfusclient.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\EULA.rtf	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\setupdrv.exe	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\vp8encoder.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.gpd	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.ini	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RIPCServer.dll	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms_s.lng	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unires_vpd.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\install.cmd	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\fwproc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\fwproc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe	rfusclient.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\fwproc.exe	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unidrv_rms.dll	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\srvinst.exe	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms.ini	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Russian.lg	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmspm.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmsui2.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RIPCServer.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\webmvorbisencoder.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\English.lg	rfusclient.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms.gpd	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\English.lg	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\SampleClient.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unidrv_rms.hlp	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RIPCServer.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\uninstall.cmd	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\progress.exe	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmsui2.exe	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmsui.dll	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\webmvorbisencoder.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\RWLN.dll	rfusclient.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.ini	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\Logs	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\Systemwinrootdir\webmmux.dll	attrib.exe
File created	C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\srvinst_x64.exe	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\12345670073.txt	cmd.exe
File created	C:\Windows\Installer\e56fc95.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9B1840F4-C937-4399-BC5C-22CA946BAE1B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e56fc95.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FCD.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
4872	taskkill.exe
444	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1228	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2912	msiexec.exe
2912	msiexec.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
4436	rutserv.exe
1984	rutserv.exe
1984	rutserv.exe
1984	rutserv.exe
1984	rutserv.exe
1984	rutserv.exe
1984	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
1036	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3076	rfusclient.exe
3076	rfusclient.exe
4084	rfusclient.exe
4084	rfusclient.exe
4084	rfusclient.exe
4084	rfusclient.exe
4756	rfusclient.exe
4756	rfusclient.exe
4756	rfusclient.exe
4756	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4756	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	444	taskkill.exe
Token: SeShutdownPrivilege	1948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1948	msiexec.exe
Token: SeSecurityPrivilege	2912	msiexec.exe
Token: SeCreateTokenPrivilege	1948	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1948	msiexec.exe
Token: SeLockMemoryPrivilege	1948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1948	msiexec.exe
Token: SeMachineAccountPrivilege	1948	msiexec.exe
Token: SeTcbPrivilege	1948	msiexec.exe
Token: SeSecurityPrivilege	1948	msiexec.exe
Token: SeTakeOwnershipPrivilege	1948	msiexec.exe
Token: SeLoadDriverPrivilege	1948	msiexec.exe
Token: SeSystemProfilePrivilege	1948	msiexec.exe
Token: SeSystemtimePrivilege	1948	msiexec.exe
Token: SeProfSingleProcessPrivilege	1948	msiexec.exe
Token: SeIncBasePriorityPrivilege	1948	msiexec.exe
Token: SeCreatePagefilePrivilege	1948	msiexec.exe
Token: SeCreatePermanentPrivilege	1948	msiexec.exe
Token: SeBackupPrivilege	1948	msiexec.exe
Token: SeRestorePrivilege	1948	msiexec.exe
Token: SeShutdownPrivilege	1948	msiexec.exe
Token: SeDebugPrivilege	1948	msiexec.exe
Token: SeAuditPrivilege	1948	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1948	msiexec.exe
Token: SeChangeNotifyPrivilege	1948	msiexec.exe
Token: SeRemoteShutdownPrivilege	1948	msiexec.exe
Token: SeUndockPrivilege	1948	msiexec.exe
Token: SeSyncAgentPrivilege	1948	msiexec.exe
Token: SeEnableDelegationPrivilege	1948	msiexec.exe
Token: SeManageVolumePrivilege	1948	msiexec.exe
Token: SeImpersonatePrivilege	1948	msiexec.exe
Token: SeCreateGlobalPrivilege	1948	msiexec.exe
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeCreateTokenPrivilege	1744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1744	msiexec.exe
Token: SeLockMemoryPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeMachineAccountPrivilege	1744	msiexec.exe
Token: SeTcbPrivilege	1744	msiexec.exe
Token: SeSecurityPrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeLoadDriverPrivilege	1744	msiexec.exe
Token: SeSystemProfilePrivilege	1744	msiexec.exe
Token: SeSystemtimePrivilege	1744	msiexec.exe
Token: SeProfSingleProcessPrivilege	1744	msiexec.exe
Token: SeIncBasePriorityPrivilege	1744	msiexec.exe
Token: SeCreatePagefilePrivilege	1744	msiexec.exe
Token: SeCreatePermanentPrivilege	1744	msiexec.exe
Token: SeBackupPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeDebugPrivilege	1744	msiexec.exe
Token: SeAuditPrivilege	1744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1744	msiexec.exe
Token: SeChangeNotifyPrivilege	1744	msiexec.exe
Token: SeRemoteShutdownPrivilege	1744	msiexec.exe
Token: SeUndockPrivilege	1744	msiexec.exe
Token: SeSyncAgentPrivilege	1744	msiexec.exe
Token: SeEnableDelegationPrivilege	1744	msiexec.exe
Token: SeManageVolumePrivilege	1744	msiexec.exe
Token: SeImpersonatePrivilege	1744	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1948	msiexec.exe
1948	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4436	rutserv.exe
1984	rutserv.exe
3096	rutserv.exe
1036	rutserv.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2244	3592	b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe	80
PID 3592 wrote to memory of 2244	3592	b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe	80
PID 3592 wrote to memory of 2244	3592	b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe	80
PID 2244 wrote to memory of 4772	2244	cmd.exe	82
PID 2244 wrote to memory of 4772	2244	cmd.exe	82
PID 2244 wrote to memory of 4772	2244	cmd.exe	82
PID 2244 wrote to memory of 5032	2244	cmd.exe	83
PID 2244 wrote to memory of 5032	2244	cmd.exe	83
PID 2244 wrote to memory of 5032	2244	cmd.exe	83
PID 2244 wrote to memory of 4872	2244	cmd.exe	84
PID 2244 wrote to memory of 4872	2244	cmd.exe	84
PID 2244 wrote to memory of 4872	2244	cmd.exe	84
PID 2244 wrote to memory of 444	2244	cmd.exe	85
PID 2244 wrote to memory of 444	2244	cmd.exe	85
PID 2244 wrote to memory of 444	2244	cmd.exe	85
PID 2244 wrote to memory of 1948	2244	cmd.exe	86
PID 2244 wrote to memory of 1948	2244	cmd.exe	86
PID 2244 wrote to memory of 1948	2244	cmd.exe	86
PID 2244 wrote to memory of 1744	2244	cmd.exe	88
PID 2244 wrote to memory of 1744	2244	cmd.exe	88
PID 2244 wrote to memory of 1744	2244	cmd.exe	88
PID 2244 wrote to memory of 1228	2244	cmd.exe	89
PID 2244 wrote to memory of 1228	2244	cmd.exe	89
PID 2244 wrote to memory of 1228	2244	cmd.exe	89
PID 2244 wrote to memory of 4156	2244	cmd.exe	90
PID 2244 wrote to memory of 4156	2244	cmd.exe	90
PID 2244 wrote to memory of 4156	2244	cmd.exe	90
PID 2912 wrote to memory of 2108	2912	msiexec.exe	92
PID 2912 wrote to memory of 2108	2912	msiexec.exe	92
PID 2912 wrote to memory of 2108	2912	msiexec.exe	92
PID 2912 wrote to memory of 4436	2912	msiexec.exe	93
PID 2912 wrote to memory of 4436	2912	msiexec.exe	93
PID 2912 wrote to memory of 4436	2912	msiexec.exe	93
PID 2912 wrote to memory of 1984	2912	msiexec.exe	94
PID 2912 wrote to memory of 1984	2912	msiexec.exe	94
PID 2912 wrote to memory of 1984	2912	msiexec.exe	94
PID 2912 wrote to memory of 3096	2912	msiexec.exe	95
PID 2912 wrote to memory of 3096	2912	msiexec.exe	95
PID 2912 wrote to memory of 3096	2912	msiexec.exe	95
PID 2244 wrote to memory of 1020	2244	cmd.exe	96
PID 2244 wrote to memory of 1020	2244	cmd.exe	96
PID 2244 wrote to memory of 1020	2244	cmd.exe	96
PID 2244 wrote to memory of 400	2244	cmd.exe	97
PID 2244 wrote to memory of 400	2244	cmd.exe	97
PID 2244 wrote to memory of 400	2244	cmd.exe	97
PID 2244 wrote to memory of 5040	2244	cmd.exe	98
PID 2244 wrote to memory of 5040	2244	cmd.exe	98
PID 2244 wrote to memory of 5040	2244	cmd.exe	98
PID 2244 wrote to memory of 1572	2244	cmd.exe	100
PID 2244 wrote to memory of 1572	2244	cmd.exe	100
PID 2244 wrote to memory of 1572	2244	cmd.exe	100
PID 1036 wrote to memory of 3076	1036	rutserv.exe	101
PID 1036 wrote to memory of 3076	1036	rutserv.exe	101
PID 1036 wrote to memory of 3076	1036	rutserv.exe	101
PID 1036 wrote to memory of 4084	1036	rutserv.exe	102
PID 1036 wrote to memory of 4084	1036	rutserv.exe	102
PID 1036 wrote to memory of 4084	1036	rutserv.exe	102
PID 4084 wrote to memory of 4756	4084	rfusclient.exe	104
PID 4084 wrote to memory of 4756	4084	rfusclient.exe	104
PID 4084 wrote to memory of 4756	4084	rfusclient.exe	104

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1020	attrib.exe
400	attrib.exe
5040	attrib.exe
1572	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe
"C:\Users\Admin\AppData\Local\Temp\b9c65893800d1c04fb13078fd3fc2bd0e7cd1fb0eac9b6bfbc9bba15ff9f32f7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System" /f
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rutserv.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfusclient.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:444
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1948
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {9B1840F4-C937-4399-BC5C-22CA946BAE1B} /passive REBOOT=ReallySuppress
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1744
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1228
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "renk_mod.msi" /qn
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r "C:\Windows\System32\Systemwinrootdir"
    3⤵
    - Views/modifies file attributes
    PID:1020
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r "C:\Windows\System32\Systemwinrootdir"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:400
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r /d /s "C:\Windows\System32\Systemwinrootdir\*.*"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:5040
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r /d /s "C:\Windows\System32\Systemwinrootdir\*.*"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C9547F6877E9136A74E7B53A97AB403
  2⤵
  - Loads dropped DLL
  PID:2108
- C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe
  "C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4436
- C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe
  "C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1984
- C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe
  "C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3096

C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe
C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe
  C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe
  C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe
    C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: SetClipboardViewer
    PID:4756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
886B

MD5
013a56b53e1a4cf60dbe26674a3ff80d

SHA1
59db88e2bd96fb551b801249fb12788483e26509

SHA256
bbcf905e07f9dcf72685e5355fbc26fc4e6428d400dcfdf7009cd74865abd222

SHA512
630c9b8baf681370e124753748bf8ab6d370b193991add0a7d2e2b98dd52f32e6d8f61f1d0444126f76572b7f775669df59901e677a1d2e93c51dc15d16b0f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\renk_mod.msi

Filesize
7.0MB

MD5
612316a1661fe4fc412c8036e0e19c60

SHA1
4c607151c2df5e7e0cc7dd53318448a97d5c994f

SHA256
9beb904d1244bbb59872353dea4592cf48681b25dc270c6c1c9ad92ef12d5330

SHA512
af188878ea917dfbfd74490cf9b29f4035b2e4a8f8ff5b498b068705e401860a79ee9699e4736d265978c42f7f90ab90c457dc4f53b10bd0ffc32e13b2ead7e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\winmm.dll

Filesize
101KB

MD5
9a5614ccf289f4142856626dc4894dea

SHA1
0d6e7097176b2920f3ed2036ea59b6379e40ce47

SHA256
aef83afa889a5fb36f5ac38fbdd6840a5bcf84666617804b31610300f66c2223

SHA512
886012ef87f5f4c6716f2700fc93583c066137f2a25f624f4eff9a699d04ec9660bc82c765d618ae3b7e7d3f80f83765813e398c384b1a0483b9c630a7a4bfb1

Download Submit
C:\Windows\Installer\MSI7DF.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\Installer\MSI7DF.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\EULA.rtf

Filesize
118KB

MD5
4da4c145104e3d4081a17d4c8860b25e

SHA1
44567ae2b0a90b7ade24493255eb193f858448e9

SHA256
8f1c3af4e2d68ebb2d09c3620af27134fcb683b4cc329d2facf333e228be6565

SHA512
c2764b8db142d6484af33f95672fef8cb2e4a1faf15e29e0d1c7fe5cef6265571fb34c7bd843b8b0de965e7ad98e011e9b09caf7bceb265ea5b7d5c621ecba03

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\English.lg

Filesize
43KB

MD5
c0ab736c7c4c28cf2ceb9bbd9a19890e

SHA1
c46a1331fd9bf6ab4a17cf11b72e22eb66314db4

SHA256
d6dff627d6f3a1e1892dfbea844fa81483452000b145ac3e72e3a8da0cdba894

SHA512
4791c9411a8a1400ff6ad9a2cd44e288bcc867ce7b148e274c91af9e1c877ada9f468b840b1f37b876c7ac665c9a6c34f363165fe3df2df62e8a57b0ed3429bd

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\VPDAgent_x64.exe

Filesize
157KB

MD5
7ae48c67835037587c65bf94b87d8e36

SHA1
884ebc7da2c97aecf0879ee96797bd7d14ccff9d

SHA256
26896c5b8d4ea10425eef789f9b6d5d408e4c5f5c0f4c86d95d8223bab144138

SHA512
638f9fab7253475bc30cbc799260bd9e865ec0db1bdd4c2c1037f109421970093eaf2d04d95d976563e2e895a50b37cd02daefcbfae0b09fbe35c263f77e285a

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\fwproc.exe

Filesize
17KB

MD5
e9d3241b579fb636c215b42d8f5ad11b

SHA1
64012a3f5d11643d4176689fff8b93056eb0ebab

SHA256
facdc556bb0c999091b319c963b4d458fb9c73cf48ab41718fedac2834cc04fb

SHA512
1bb4798e38a480152407c03c362dfd36e546742e31700d2940bad6fde8ec9031c5fbd08a538d4e47e68a00ad080b108a799c3f593217499f580e0b93699e24b3

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\install.cmd

Filesize
68B

MD5
921adb25b2323226764ccface8bc087a

SHA1
0e657a741ec92704fe2e9b19f7eb0890cba02b1c

SHA256
e71036db28270fff2f386049abcd8b1340f66871c3c6cc64195c4de30d886464

SHA512
b91cc962438e4a7afd4324b81d84b3721dc44a49e9c674fa92a5363f8e393ba64bf99aca852b375620d7a4e84a09a8af591df4531346cc936559f80a91cdc999

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\ntprint.inf

Filesize
9KB

MD5
6476f7217d9d6372361b9e49d701fb99

SHA1
e1155ab2acc8a9c9b3c83d1e98f816b84b5e7e25

SHA256
6135d3c9956a00c22615e53d66085dabbe2fbb93df7b0cdf5c4f7f7b3829f58b

SHA512
b27abd8ed640a72424b662ae5c529cdda845497dc8bd6b67b0b44ae9cdd5e849f627e1735108b2df09dd6ef83ad1de6faa1ad7a6727b5d7a7985f92a92ca0779

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\progress.exe

Filesize
19KB

MD5
8f9285a63d60e2ebce61dfa53fb42c86

SHA1
09579c929eb86949bdd068a2f6e7c1e5a305f9b1

SHA256
d48b3ebd472de966f2df2509d1bd82cb8b2ea1f5240426a72067390ddc3fa582

SHA512
379c2dd0809e9f2d9d4f57a038352d1b52decf5878821e93d209c56c335ea1e1f7e3b8f2e5bd8f2848ed731d97ebebd3a6b2c413e1218d4b22bf80786c5e3e2e

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms.gpd

Filesize
14KB

MD5
151f3af412abd6bf05d160a70f8873d8

SHA1
0efcf48401d546ce101920496dcbbf3ab252ee87

SHA256
4c21b9663120b494d0f5112eb5f9e0aab4b659a5bf5d5301ee4d5a98abb20f25

SHA512
58513727d12cc915cd8445a078beb238aa3df28cc49b3733d487b0d3100f1c519b39f5b809ace618536e2d8951c1b3a58c0763a893bbd92a98c8e06575d92a4f

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms.ini

Filesize
40B

MD5
58ded3cb7ca70a6975c5419c62fdb51d

SHA1
274040c32983b7fbf01f65e41b375f255a78547d

SHA256
425dbedfc4a8a0672478b0b97e28568e5007e9813bba650fe727b252f43a0dfc

SHA512
c9f3b324adc89be54ccace827c0b0b759f8658a63a6c9689c2bc5f01388daa25b8ea80f8c3b624403a2cae784af5cf0e5a94919795263a31ab9769969fd08a42

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms.lng

Filesize
25KB

MD5
de5b0b40318ceabef85c04260141b039

SHA1
450df0a73f682425f631af1bd8b1960490498427

SHA256
7633ce5b3d2f8fea91207cdc1b2252b81606be1b5ffafedd56220cfd07f36c49

SHA512
2afdbce31039b77761173a3d8a87970a99b152a97048a8710b0d5b4876bd7602dbbf8b5315fe5f4da69d093871ee59c626198371ccdea6180d7e651b871ac91b

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rms_s.lng

Filesize
1KB

MD5
6f06958e2d405c60521a3ce618e5ae7f

SHA1
8344c137a187900e7984c1bbff1c0ff5ca1e0023

SHA256
2da89d774f6b830400a3d95e94fd706084b4e28c0078a54c8fc5c01b981a01bf

SHA512
469673e3b09a142d80a1026709fc23abafc3a250d9574c681fb6066aa3c0f06800f60a6dfde7ccf2f3a47902f0eb2647dcd206f59d7bc3861eaf5e4fe721a511

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmspm.dll

Filesize
59KB

MD5
f2cef33655d4cacabadb395549486911

SHA1
17ced65ff112076b64d4d09fe50992d037a783e5

SHA256
60cbea2c664d144bca4e41bf90eff0bae1ab270f9ef38b2bd2dd6d569b3bd104

SHA512
0eba2e99f4f79923024f7297fbb65dbaf4478d4115fa549ec0b1b50f2e1ab455238eec03e6fae70455000ad21349ba87d136ea027707adc9c6f1ffd02942a79d

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmsui.dll

Filesize
24KB

MD5
5cd2c94c735acf7ee2b0aec5bf8586ff

SHA1
74ee88b26abdcc7b39eb86b6cd09315dde67b99e

SHA256
f60f21cb8fc3a482926ef05adacee26b2ba503c793b4d5ba26772776cf73e1d7

SHA512
a1074d958b483785a9d260f150967c9a022a5b50652ffed1c1ca3cc9508ab3df0d800b181b11211f92bfdaf9e62faa546448882a077de84be0292faa4c7e927e

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\rmsui2.exe

Filesize
214KB

MD5
33ca4ecb77167709684355c8f5eb2101

SHA1
9f75e80ed8f2101c2a1cf9eaf92f5faa45fcd842

SHA256
e0f211121eaeb5e299afb14ef108be1da503c5b93611dc9a446d5db6af48ac5c

SHA512
9d7d40e8ab4677eb117274327a67130b8f17105d135ddee0ee1bb5b25286c071673ea37d63607345b7c9abb84a7a10b51df77aafd4cdc2e2421b87953f6aa01c

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\setupdrv.exe

Filesize
64KB

MD5
8d44f7ad83e1b334489061a53ea3ac71

SHA1
02eb085da6fd5ba0f6a1e43e48606fbe7e4b2e15

SHA256
cf00478c8ce5a60341c685ee69c67a490800645a61cf8cf17dd087b9f02a5cd9

SHA512
626d210a2d073834e7f3a184347695d66ab914cfbae7bbc955d1aa49c90e9173c1632396780951b505614729c5a3364bbcaee17bcd3f521701bdcf8b84226d3b

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\srvinst_x64.exe

Filesize
39KB

MD5
cedb47552c860e34e715b6efd6057585

SHA1
88a55507d8350ba032ac9c8d97a42223b01d8fc4

SHA256
f85f3ed1c1332fe96fbe1ba2c9382e8c6d250ac5b9fbcfd9bf5eb9a7f5e18ca1

SHA512
4d80673069053bbda51633242bc7afa905ad07a9130625c84d4c0e68121ac529269bf36f773cdce98f3d5b89ee226bb3cf87e3deef5ad99449582a642cde5699

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\stdnames_vpd.gpd

Filesize
14KB

MD5
7162d8977515a446d2c1e139da59ded5

SHA1
952f696c463b8410b1fa93a3b2b6dae416a81867

SHA256
2835a439c6ae22074bc3372491cb71e6c2b72d0c87ae3eee6065c6caadf1e5c8

SHA512
508f7ca3d4bc298534ab058f182755851051684f8d53306011f03875804c95e427428bd425dd13633eec79748bb64e78aad43e75b70cc5a3f0f4e6696dbb6d8e

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unidrv_rms.dll

Filesize
473KB

MD5
92caef70acb5f592c34858edfc7c4d92

SHA1
dd666debefd595dc6770bfce07a2bc013a3247a3

SHA256
66b6ce0dbe01bffa41a63413b02722362af282fcf58259f4dfe4c0501d2dadb7

SHA512
b6d849c9ede4728b95bf5d98e9fcc5d64d160df83a58bc298cbc13d66e2496dfd0f55c900d135ed31cf7cad4949c26adcb59bf12dceb79de89a355694a803db0

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unidrv_rms.hlp

Filesize
20KB

MD5
6798f64959c913673bd66cd4e47f4a65

SHA1
c50faa64c8267ac7106401e69da5c15fc3f2034c

SHA256
0c02b226be4e7397f8c98799e58b0a512515e462ccdaac04edc10e3e1091c011

SHA512
8d208306b6d0f892a2f16f8070a89d8edb968589896cb70cf46f43bf4befb7c4ca6a278c35fe8a2685cc784505efb77c32b0aabf80d13bcc0d10a39ae8afb55a

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unidrvui_rms.dll

Filesize
869KB

MD5
3cbe352ee76bfbae8c5abdf6e6e3e967

SHA1
9393dfa89142cc984c6f5f4683be1fdb96a0622b

SHA256
687f2f9c180285b5c4130907515da8507fb2ff178268fd159bec6bb361e0f789

SHA512
b1ef8b7c4febf300af34c722d6509a739faaa5d0a54e0d5a41ce69af86ade9c5a2ac36ea5fcc2ada577f168704935194e9b6f2bbb9cbc89d1265aa0a1135a946

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\uninstall.cmd

Filesize
87B

MD5
24837286ab8b5537ea3967e0a7905238

SHA1
4f3dc09d2f0c9ede72577154b9954621dd30604b

SHA256
f6ebaa2bc59841b72aaf3c03c7bfea91c75ec1f982f497d6b3d7fb7271cacdf6

SHA512
6b0cfd707fbab7034ef45b4864329a9ad01f649216fe13aede6bf6488b50020da65f8a3776c1b125eebe08aef6a848d04a33de8277a2ad3827c8869af1368c00

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x64\unires_vpd.dll

Filesize
750KB

MD5
1502d991f710ae9b97661b291a6ee4f7

SHA1
7e9da0269dcd8110486227b6585282831b68389c

SHA256
df403937d30cec7e12ed31e3291a321784495c21b8f5ff33977d8960a7747288

SHA512
1fd560a5a620a1259579e07fbe109330403610d7267929b9576ed10a9108d6d15e8531e2c7fb93c451280e03b1d7aa6eaf52094922896051c4e05e197e403d94

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\SampleClient.exe

Filesize
16KB

MD5
730baa838132bc9623894514f3a63dc8

SHA1
29e540517a0fb7dad1017a74be118c908206ef77

SHA256
0d5b7ae98251f85ed5b8061c4345b357db313df2d5c9eb00bcf48b72be58cc72

SHA512
453a62765fcf7a796807a9596d1e72b7b1aa1bf84301533cd2c23b2ec9a3115165487e79eb3a6a22e51b3922ab605894bec0573d73e114384b111fad70f01c91

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\VPDAgent.exe

Filesize
197KB

MD5
8245aae08a4749a513d95aada4983417

SHA1
a108b0e6984c5ca540d0443af287058a707a47ec

SHA256
1f095b754c7c7b523425f723ea1777c193c4d8127012b49c47524cbae6415b4c

SHA512
f8262715ba42a2eb0ec8f65a5d803e2c949474ce82d66741e38cba984a657d5856624ac36e4bc2d9f60258e01d2417b4a582464a31835ec613f313fad5add409

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\fwproc.exe

Filesize
85KB

MD5
eefa63ac2393b4ff8470797fad3c1812

SHA1
1fb9655150b2f9a9bd08c95ac2f6153b2ca094cb

SHA256
8bdba4a26ad8536a1150f8a9db275cc96e25f0844c25a4a3a291e7301fb15b2b

SHA512
ba41b036fb25382d1d9680ab78095f42d6b30b27b59ef83e0b77b90a78c2a4e8dfac69efdfff0a3e6856b1680e9b720186e0997226c4986606c1bf196566f6ea

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\install.cmd

Filesize
60B

MD5
23ada030ee52b855789e8fb0db6b5c4b

SHA1
1f5b1274d7f86fbe2675c9c702196711de2a6d50

SHA256
e7ad95fc7303838383f6fddea9615bb70de8579f53e5df581c1557a01c37ce5e

SHA512
8acbd8a505173103f53f32c15e00ea81ffb6e749ec835f42a025e669045f9a020fbc9495b72b621c43311de1273cd80275b60ce9fee789557621e24c9ab7ca38

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\ntprint.inf

Filesize
9KB

MD5
6476f7217d9d6372361b9e49d701fb99

SHA1
e1155ab2acc8a9c9b3c83d1e98f816b84b5e7e25

SHA256
6135d3c9956a00c22615e53d66085dabbe2fbb93df7b0cdf5c4f7f7b3829f58b

SHA512
b27abd8ed640a72424b662ae5c529cdda845497dc8bd6b67b0b44ae9cdd5e849f627e1735108b2df09dd6ef83ad1de6faa1ad7a6727b5d7a7985f92a92ca0779

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\progress.exe

Filesize
16KB

MD5
d43bc24fdbd795084bc28a2fe8910ce6

SHA1
842962392b0c84446502d7dd4671e9e97fa56b62

SHA256
4b92d05bf81b3bf3877c63bda63007dfd6b4ae8ce64d3a1521d4d5d03e0b94a2

SHA512
9a46b5262b6ac18b48a86c5d0bd4d8cc717c83e13c3e40fff13b65498a4186bc26e5861b54a760152e2705f15d144caabed9727e93a4ca3186336f6af8a94a9f

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.gpd

Filesize
14KB

MD5
151f3af412abd6bf05d160a70f8873d8

SHA1
0efcf48401d546ce101920496dcbbf3ab252ee87

SHA256
4c21b9663120b494d0f5112eb5f9e0aab4b659a5bf5d5301ee4d5a98abb20f25

SHA512
58513727d12cc915cd8445a078beb238aa3df28cc49b3733d487b0d3100f1c519b39f5b809ace618536e2d8951c1b3a58c0763a893bbd92a98c8e06575d92a4f

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.ini

Filesize
40B

MD5
58ded3cb7ca70a6975c5419c62fdb51d

SHA1
274040c32983b7fbf01f65e41b375f255a78547d

SHA256
425dbedfc4a8a0672478b0b97e28568e5007e9813bba650fe727b252f43a0dfc

SHA512
c9f3b324adc89be54ccace827c0b0b759f8658a63a6c9689c2bc5f01388daa25b8ea80f8c3b624403a2cae784af5cf0e5a94919795263a31ab9769969fd08a42

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms.lng

Filesize
25KB

MD5
de5b0b40318ceabef85c04260141b039

SHA1
450df0a73f682425f631af1bd8b1960490498427

SHA256
7633ce5b3d2f8fea91207cdc1b2252b81606be1b5ffafedd56220cfd07f36c49

SHA512
2afdbce31039b77761173a3d8a87970a99b152a97048a8710b0d5b4876bd7602dbbf8b5315fe5f4da69d093871ee59c626198371ccdea6180d7e651b871ac91b

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rms_s.lng

Filesize
1KB

MD5
6f06958e2d405c60521a3ce618e5ae7f

SHA1
8344c137a187900e7984c1bbff1c0ff5ca1e0023

SHA256
2da89d774f6b830400a3d95e94fd706084b4e28c0078a54c8fc5c01b981a01bf

SHA512
469673e3b09a142d80a1026709fc23abafc3a250d9574c681fb6066aa3c0f06800f60a6dfde7ccf2f3a47902f0eb2647dcd206f59d7bc3861eaf5e4fe721a511

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rmspm.dll

Filesize
53KB

MD5
2d7fa1ae8a86e2f6929d35a7cb6887f1

SHA1
1473780ca24a9439a76a662edaa7c1e19eb73ed2

SHA256
260b062b9f4615b827e66bd440538635c24535bcbfa8e4633211c3a2e2b200af

SHA512
592b18a267e84f5a91adfb0c72923315e7b72f20f57be2c21e3720508e0f814492151837e74a77e1aeb7c49b4c6b44e5bc052e3621346ba202307dca040fa863

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rmsui.dll

Filesize
24KB

MD5
24d2429a89f23f47fb66e8052adc678f

SHA1
877711b1f7a8609d90f09db723508e3368674823

SHA256
8ab65ada650b1f0d9ad026c22d45d737231c17ac05d602783161914b623d880f

SHA512
4e0e8f3901ffa0255b9ae045cb283dd56da4ec6527c073328bad8c12bfaf594e0d5a7a529099d912d2c7750276a5a09e3f7bf0e194115f8836654ab6985f22c0

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\rmsui2.exe

Filesize
169KB

MD5
1edfe79c69deeef04dfcf7d3e0763121

SHA1
4a5593f6942309df2090f8c56fdf32f85c198c31

SHA256
9167b0273abe0c0063d24a290cb31cf4da21e786658fad28c29710649ebd2953

SHA512
f83bf4d7b44dee008d85f1753c1afdd676d213df39b2e20f201d0940417034d5345fa78a1ac55caabc87376518d701224ab809ecbe315a07e3445a446a5609c8

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\setupdrv.exe

Filesize
57KB

MD5
12fef7d5dfe001ae43bd27e081346c2b

SHA1
0b99417bb3f0fc9892c46e6cf0fc4a4238691b13

SHA256
c7bb50d1dfb4488f62458cde5b87f80c5072c73b5f080e32ecd70ce2332a27b5

SHA512
ce7f51d7223efd065629b7a09be3f3ea90e8e842ec10d12f0bb927f4a86c16e424867ce6abc1f411e9caab681bf2d78e4828d9f2f883ad118e52cb090a987c76

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\srvinst.exe

Filesize
101KB

MD5
7b03f2401cb8487ad31eecffcef6e2a5

SHA1
2a39e3b06b35eefb32fae5737a549e5821fff0aa

SHA256
3355b2be0b09066fabac99f757b75ffe1d1239d190a30f167e8d14273e148318

SHA512
97aebf16a31ba37f76cbf5ca354aa26f2148dc176d6cc893f5d9b372224e599be9aa5aa99dcf4ea4801f9d262397db5bffd9bb854c882cf5e94411d528c53a86

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\stdnames_vpd.gpd

Filesize
14KB

MD5
7162d8977515a446d2c1e139da59ded5

SHA1
952f696c463b8410b1fa93a3b2b6dae416a81867

SHA256
2835a439c6ae22074bc3372491cb71e6c2b72d0c87ae3eee6065c6caadf1e5c8

SHA512
508f7ca3d4bc298534ab058f182755851051684f8d53306011f03875804c95e427428bd425dd13633eec79748bb64e78aad43e75b70cc5a3f0f4e6696dbb6d8e

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unidrv_rms.dll

Filesize
372KB

MD5
f04096fcd5c1445c2261faa0cbc9f149

SHA1
ff5af7e661f1bc6fec56385f5bf2306707e932ab

SHA256
4f853d46950213605b3c54e2b843f60ef63c639b7c7a8b51430417a1cfc6d7e9

SHA512
140b796042074ad0d70526b09022ffada26f5d37b00565995cb074de5a6e08dd8d13e0fd7a87753a77a809e28065b979e6ae47abb4f8d9c59f83618b3c1595db

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unidrv_rms.hlp

Filesize
20KB

MD5
6798f64959c913673bd66cd4e47f4a65

SHA1
c50faa64c8267ac7106401e69da5c15fc3f2034c

SHA256
0c02b226be4e7397f8c98799e58b0a512515e462ccdaac04edc10e3e1091c011

SHA512
8d208306b6d0f892a2f16f8070a89d8edb968589896cb70cf46f43bf4befb7c4ca6a278c35fe8a2685cc784505efb77c32b0aabf80d13bcc0d10a39ae8afb55a

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unidrvui_rms.dll

Filesize
735KB

MD5
97c25e40557bde38b413f165c5c37300

SHA1
d6f8adfc26160d3a220f29e8679da011aa0cbf08

SHA256
b846c393dbe4398887e1d3cee76481c05dc343d0ea53f09b819c8a5d9fbc252e

SHA512
04559a560fb9a87c4f4ede6ba777ec20ce6054fdc60d22623497af3b1a731753518bb7f789849bd7f1b685288d177caec0203bbdcd9a8c448f08bc87ebbdd5d6

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\uninstall.cmd

Filesize
79B

MD5
2c6ec773a407fd9bcba6fd1a273912c9

SHA1
1fe0b0b8dd115fa853e193c4d6cc8882992cbdaa

SHA256
ad608f5672b2310308bf84919d4e2202a53e99854a4a0945ee38bacbb6ef8e72

SHA512
4d13327048961b031f1297f0064a587257011ae1b712d0f6702b4b0a17835e6202d2f64b578d543a3e564f038bdeb88cca032a2d402dfc1c0519f247366da428

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Printer\x86\unires_vpd.dll

Filesize
750KB

MD5
896a5f7ac41766fcae5de32fdbfe962d

SHA1
118300952bf300e7e8484bd5461245386f2f702b

SHA256
09a05139d934642a412b3d60702e77380ee7a9e979f46c7f61e2c5258995dabc

SHA512
bb8ba982639de9ec46de01badc998f90ef15f5a31cf9656a9b2ccd70b17e95f2d02b38f1be9eec2667cdcf971a65691fd9e5debfb7731873cac11361243239ab

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\RIPCServer.dll

Filesize
144KB

MD5
de0e701b512a180ee324a7db45ac3723

SHA1
b448c0a5e98526181c1f71db8ca47b3247519dbd

SHA256
5d5d86ddae52ccbed8fe1638926da9390c01b828dcd62fe6392f582f9ed58d2f

SHA512
2d86f0bc35bd05d8a3d40d4403def974d621abfa21f01683f6f5f9f4622149f39fc42de50edf37259127a369478e45f633ca79570727b811a431a95764778506

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\RWLN.dll

Filesize
975KB

MD5
cb8a716e0ae37612e87814977d96fc77

SHA1
5345318ff76b675828fb9dbb2df90cdc0c0a75b2

SHA256
a636f7d68bc44da7fff43b8acc0cde7656668147f9cffeae22f3e186cc83ccfb

SHA512
354cd8a4c249c11793be06cd8291168d2add024aa23b88dd01068582f7c13ae1dc71482217578823afe01086f12e4f8fd3582bf5b11067e29d9bf3b26ca88682

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\Russian.lg

Filesize
48KB

MD5
283f92599d9e35c6ac33b9c40a4ed23b

SHA1
2d2e2ef10d45d5905bb2ba93aee92dd5fb7b3e1d

SHA256
bc90bf4d03466ac709373ad4a232cf6fa43b3364f6eba4ea691cf73d452326ba

SHA512
acbc77de335a679a655ba6380558c247238e5b952fe689e942e07935cc1da8ce4fb672635561dc602d6f6341fb3803ab98e15c3ba41160f72a8a231d2b1f7791

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\rfusclient.exe

Filesize
5.2MB

MD5
b30061291342d8e9e3ddb59312415fef

SHA1
887f67b47a422a78216200fe428c158c93b64ad4

SHA256
45b57d8d2f2e08ac2c739447af12078163fa7c37955d53131f0c5a54b5fac226

SHA512
350deb596ce3aff972ec749ec67fdb4c331f70300cad0bca6c7c89f2f137ee47f480a3168f701aaa7b3b86fa0245cc989e39155f725c0353fcd52a6de9eda403

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe

Filesize
6.2MB

MD5
666c7d0c5a8036b8357f841eff302731

SHA1
ed1ca91a9bbe5b44832e8a656c89de7139a1893f

SHA256
8b6674de49f643314c076d8b4618d894b9aeaa30ddb489f2780ba2504df773b7

SHA512
7ca8990f93980b8dce62d99b5284ea997bd54a57c0ad423cff7647522062004f3bca2f52866d9a66c1fde83cdbf020f266b818ffda46ab4aa6f7a1e1bd492a25

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe

Filesize
6.2MB

MD5
666c7d0c5a8036b8357f841eff302731

SHA1
ed1ca91a9bbe5b44832e8a656c89de7139a1893f

SHA256
8b6674de49f643314c076d8b4618d894b9aeaa30ddb489f2780ba2504df773b7

SHA512
7ca8990f93980b8dce62d99b5284ea997bd54a57c0ad423cff7647522062004f3bca2f52866d9a66c1fde83cdbf020f266b818ffda46ab4aa6f7a1e1bd492a25

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe

Filesize
6.2MB

MD5
666c7d0c5a8036b8357f841eff302731

SHA1
ed1ca91a9bbe5b44832e8a656c89de7139a1893f

SHA256
8b6674de49f643314c076d8b4618d894b9aeaa30ddb489f2780ba2504df773b7

SHA512
7ca8990f93980b8dce62d99b5284ea997bd54a57c0ad423cff7647522062004f3bca2f52866d9a66c1fde83cdbf020f266b818ffda46ab4aa6f7a1e1bd492a25

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\rutserv.exe

Filesize
6.2MB

MD5
666c7d0c5a8036b8357f841eff302731

SHA1
ed1ca91a9bbe5b44832e8a656c89de7139a1893f

SHA256
8b6674de49f643314c076d8b4618d894b9aeaa30ddb489f2780ba2504df773b7

SHA512
7ca8990f93980b8dce62d99b5284ea997bd54a57c0ad423cff7647522062004f3bca2f52866d9a66c1fde83cdbf020f266b818ffda46ab4aa6f7a1e1bd492a25

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\vp8decoder.dll

Filesize
368KB

MD5
e48c0e66dbfef46696c92785d158ddc7

SHA1
7a333891d6000603ecb9a9bac3784fff78f88718

SHA256
54911e050fce3345ec0d05c7cd02c2d345921dcf3aca724f072277bda0c6995c

SHA512
98004dabfb09f207997d82f304a57eefdb6e94764ac958c0b314a2e16293454c3e22bb0a6ff1cacfd2f5f675e8f7a8bf6594924ec29e23e11d035fd6c0e4cb66

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\vp8encoder.dll

Filesize
624KB

MD5
52c276be805fe7b86fed6755bb4211d9

SHA1
34c4fa24890fefba170eb065c546b56ada981777

SHA256
7a30f464ad62611212fbd6db948b814cb0d0e8093ddae9fd0c2ecf320b58d722

SHA512
735a8645419e89a9421ead028658a897e9f894de65fe47f1da23c08065d55cdff02acbe9d0ae75cf388d9bd03ea87121e4f555cbdf862df8add067262fea3cd9

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\webmmux.dll

Filesize
236KB

MD5
6392e8c2b5c504f559754edf8f67329d

SHA1
2a35861aafd4c0535ebfcb3cd2f654870fb5aaf1

SHA256
6f66529a6628072ccdab8f0f2234775f58c10d33ac0369294f469be9fa917c8e

SHA512
fc99fc4a444571cce48a0319674b9d958409aa34e1724560a0e407b8ebfda45f1545c19e142021e92aba8e287a5c82501952f63e079fa6914a784c27fb0dd261

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll

Filesize
101KB

MD5
9a5614ccf289f4142856626dc4894dea

SHA1
0d6e7097176b2920f3ed2036ea59b6379e40ce47

SHA256
aef83afa889a5fb36f5ac38fbdd6840a5bcf84666617804b31610300f66c2223

SHA512
886012ef87f5f4c6716f2700fc93583c066137f2a25f624f4eff9a699d04ec9660bc82c765d618ae3b7e7d3f80f83765813e398c384b1a0483b9c630a7a4bfb1

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll

Filesize
101KB

MD5
9a5614ccf289f4142856626dc4894dea

SHA1
0d6e7097176b2920f3ed2036ea59b6379e40ce47

SHA256
aef83afa889a5fb36f5ac38fbdd6840a5bcf84666617804b31610300f66c2223

SHA512
886012ef87f5f4c6716f2700fc93583c066137f2a25f624f4eff9a699d04ec9660bc82c765d618ae3b7e7d3f80f83765813e398c384b1a0483b9c630a7a4bfb1

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll

Filesize
101KB

MD5
9a5614ccf289f4142856626dc4894dea

SHA1
0d6e7097176b2920f3ed2036ea59b6379e40ce47

SHA256
aef83afa889a5fb36f5ac38fbdd6840a5bcf84666617804b31610300f66c2223

SHA512
886012ef87f5f4c6716f2700fc93583c066137f2a25f624f4eff9a699d04ec9660bc82c765d618ae3b7e7d3f80f83765813e398c384b1a0483b9c630a7a4bfb1

Download Submit
C:\Windows\SysWOW64\Systemwinrootdir\winmm.dll

Filesize
101KB

MD5
9a5614ccf289f4142856626dc4894dea

SHA1
0d6e7097176b2920f3ed2036ea59b6379e40ce47

SHA256
aef83afa889a5fb36f5ac38fbdd6840a5bcf84666617804b31610300f66c2223

SHA512
886012ef87f5f4c6716f2700fc93583c066137f2a25f624f4eff9a699d04ec9660bc82c765d618ae3b7e7d3f80f83765813e398c384b1a0483b9c630a7a4bfb1

Download Submit