rms | 7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe
Size

5.6MB
MD5

7cea6423e3e64ba10970bfb85e00f870
SHA1

c7746f81e20e4e91b6561a9fc0dd8208a68d6a97
SHA256

7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7
SHA512

7be8f14fa8dae215d91ddb766b9f4ecab417c0d66f78dfb440593023e9f724cc5bc99ac338c0ae0f6cd4204a590dbef96d545947e18e209fa93846a522b7e410
SSDEEP

98304:n3EK/++6Vi0c8bxdes9qRAYCEZtub6Rkxugl3eGXv1KyhtOte65KlE9UyMb:n3f9vgxnwRAosAyeGfMyrvd

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 10 IoCs

Processes:

rfusclient.exerutserv.exerfusclient.exerutserv.exerfusclient.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
5052	rfusclient.exe
4544	rutserv.exe
1008	rfusclient.exe
864	rutserv.exe
3800	rfusclient.exe
564	rutserv.exe
4460	rutserv.exe
4588	rfusclient.exe
2368	rfusclient.exe
1944	rfusclient.exe

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2052 attrib.exe

pid	process
2052	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid	process
3460	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
5116	MsiExec.exe
3460	MsiExec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description ioc process

File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe
File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe

description	ioc	process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Manipulator System - Server\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\help.chm	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI3B75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D3B.tmp	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{11A90858-40BB-4858-A2DA-CA6495B5E907}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C11.tmp	msiexec.exe
File created	C:\Windows\Installer\e57322f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File created	C:\Windows\Installer\e57322c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57322c.msi	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

rfusclient.exemsiexec.exerfusclient.exerfusclient.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8decoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Encoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisEncoder.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\ = "VP8 Decoder Filter Type Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "WebM.VP8Encoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\ProductName = "Remote Manipulator System - Server"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FilterData = 02000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000080000000900000003174793300000000a0000000b00000003274793300000000a0000000c00000003170693308000000000000000100000000000000000000003074793300000000a0000000d0000000131789604fc26747b6c96ca05b3338fc8eeb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a0bd12f8d41586b4a8905588fec1aded90100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CurVer\ = "Webm.VP8Decoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "Webm.VP8Decoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F4-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID\ = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Version = "83951616"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\CLSID = "{05A1D945-A794-44EF-B41A-2F851A117155}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8decoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Property Page"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "Webm.VP8Decoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CLSID\ = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70\Remote_Office_Manager	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisDecoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer\ = "WebM.VP8Encoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F1-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

456 PING.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exerutserv.exerfusclient.exe

pid process

60 msiexec.exe
60 msiexec.exe
4460 rutserv.exe
4460 rutserv.exe
4460 rutserv.exe
4460 rutserv.exe
4588 rfusclient.exe
4588 rfusclient.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

1944 rfusclient.exe

pid	process
456	PING.EXE

pid	process
60	msiexec.exe
60	msiexec.exe
4460	rutserv.exe
4460	rutserv.exe
4460	rutserv.exe
4460	rutserv.exe
4588	rfusclient.exe
4588	rfusclient.exe

pid	process
1944	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	60	msiexec.exe
Token: SeCreateTokenPrivilege	1196	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1196	msiexec.exe
Token: SeLockMemoryPrivilege	1196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1196	msiexec.exe
Token: SeMachineAccountPrivilege	1196	msiexec.exe
Token: SeTcbPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	1196	msiexec.exe
Token: SeTakeOwnershipPrivilege	1196	msiexec.exe
Token: SeLoadDriverPrivilege	1196	msiexec.exe
Token: SeSystemProfilePrivilege	1196	msiexec.exe
Token: SeSystemtimePrivilege	1196	msiexec.exe
Token: SeProfSingleProcessPrivilege	1196	msiexec.exe
Token: SeIncBasePriorityPrivilege	1196	msiexec.exe
Token: SeCreatePagefilePrivilege	1196	msiexec.exe
Token: SeCreatePermanentPrivilege	1196	msiexec.exe
Token: SeBackupPrivilege	1196	msiexec.exe
Token: SeRestorePrivilege	1196	msiexec.exe
Token: SeShutdownPrivilege	1196	msiexec.exe
Token: SeDebugPrivilege	1196	msiexec.exe
Token: SeAuditPrivilege	1196	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1196	msiexec.exe
Token: SeChangeNotifyPrivilege	1196	msiexec.exe
Token: SeRemoteShutdownPrivilege	1196	msiexec.exe
Token: SeUndockPrivilege	1196	msiexec.exe
Token: SeSyncAgentPrivilege	1196	msiexec.exe
Token: SeEnableDelegationPrivilege	1196	msiexec.exe
Token: SeManageVolumePrivilege	1196	msiexec.exe
Token: SeImpersonatePrivilege	1196	msiexec.exe
Token: SeCreateGlobalPrivilege	1196	msiexec.exe
Token: SeShutdownPrivilege	2340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2340	msiexec.exe
Token: SeCreateTokenPrivilege	2340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2340	msiexec.exe
Token: SeLockMemoryPrivilege	2340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2340	msiexec.exe
Token: SeMachineAccountPrivilege	2340	msiexec.exe
Token: SeTcbPrivilege	2340	msiexec.exe
Token: SeSecurityPrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeLoadDriverPrivilege	2340	msiexec.exe
Token: SeSystemProfilePrivilege	2340	msiexec.exe
Token: SeSystemtimePrivilege	2340	msiexec.exe
Token: SeProfSingleProcessPrivilege	2340	msiexec.exe
Token: SeIncBasePriorityPrivilege	2340	msiexec.exe
Token: SeCreatePagefilePrivilege	2340	msiexec.exe
Token: SeCreatePermanentPrivilege	2340	msiexec.exe
Token: SeBackupPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeShutdownPrivilege	2340	msiexec.exe
Token: SeDebugPrivilege	2340	msiexec.exe
Token: SeAuditPrivilege	2340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2340	msiexec.exe
Token: SeChangeNotifyPrivilege	2340	msiexec.exe
Token: SeRemoteShutdownPrivilege	2340	msiexec.exe
Token: SeUndockPrivilege	2340	msiexec.exe
Token: SeSyncAgentPrivilege	2340	msiexec.exe
Token: SeEnableDelegationPrivilege	2340	msiexec.exe
Token: SeManageVolumePrivilege	2340	msiexec.exe
Token: SeImpersonatePrivilege	2340	msiexec.exe
Token: SeCreateGlobalPrivilege	2340	msiexec.exe
Token: SeShutdownPrivilege	228	msiexec.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.execmd.exemsiexec.exerfusclient.exerfusclient.exerfusclient.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 4984 wrote to memory of 4132	4984	7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe	cmd.exe
PID 4984 wrote to memory of 4132	4984	7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe	cmd.exe
PID 4984 wrote to memory of 4132	4984	7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe	cmd.exe
PID 4132 wrote to memory of 628	4132	cmd.exe	chcp.com
PID 4132 wrote to memory of 628	4132	cmd.exe	chcp.com
PID 4132 wrote to memory of 628	4132	cmd.exe	chcp.com
PID 4132 wrote to memory of 1196	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 1196	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 1196	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 2340	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 2340	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 2340	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 456	4132	cmd.exe	PING.EXE
PID 4132 wrote to memory of 456	4132	cmd.exe	PING.EXE
PID 4132 wrote to memory of 456	4132	cmd.exe	PING.EXE
PID 4132 wrote to memory of 228	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 228	4132	cmd.exe	msiexec.exe
PID 4132 wrote to memory of 228	4132	cmd.exe	msiexec.exe
PID 60 wrote to memory of 3460	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 3460	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 3460	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 5116	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 5116	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 5116	60	msiexec.exe	MsiExec.exe
PID 60 wrote to memory of 5052	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 5052	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 5052	60	msiexec.exe	rfusclient.exe
PID 5052 wrote to memory of 4544	5052	rfusclient.exe	rutserv.exe
PID 5052 wrote to memory of 4544	5052	rfusclient.exe	rutserv.exe
PID 5052 wrote to memory of 4544	5052	rfusclient.exe	rutserv.exe
PID 60 wrote to memory of 1008	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 1008	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 1008	60	msiexec.exe	rfusclient.exe
PID 1008 wrote to memory of 864	1008	rfusclient.exe	rutserv.exe
PID 1008 wrote to memory of 864	1008	rfusclient.exe	rutserv.exe
PID 1008 wrote to memory of 864	1008	rfusclient.exe	rutserv.exe
PID 60 wrote to memory of 3800	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 3800	60	msiexec.exe	rfusclient.exe
PID 60 wrote to memory of 3800	60	msiexec.exe	rfusclient.exe
PID 3800 wrote to memory of 564	3800	rfusclient.exe	rutserv.exe
PID 3800 wrote to memory of 564	3800	rfusclient.exe	rutserv.exe
PID 3800 wrote to memory of 564	3800	rfusclient.exe	rutserv.exe
PID 4132 wrote to memory of 2052	4132	cmd.exe	attrib.exe
PID 4132 wrote to memory of 2052	4132	cmd.exe	attrib.exe
PID 4132 wrote to memory of 2052	4132	cmd.exe	attrib.exe
PID 4132 wrote to memory of 2724	4132	cmd.exe	reg.exe
PID 4132 wrote to memory of 2724	4132	cmd.exe	reg.exe
PID 4132 wrote to memory of 2724	4132	cmd.exe	reg.exe
PID 4460 wrote to memory of 4588	4460	rutserv.exe	rfusclient.exe
PID 4460 wrote to memory of 4588	4460	rutserv.exe	rfusclient.exe
PID 4460 wrote to memory of 4588	4460	rutserv.exe	rfusclient.exe
PID 4460 wrote to memory of 2368	4460	rutserv.exe	rfusclient.exe
PID 4460 wrote to memory of 2368	4460	rutserv.exe	rfusclient.exe
PID 4460 wrote to memory of 2368	4460	rutserv.exe	rfusclient.exe
PID 4588 wrote to memory of 1944	4588	rfusclient.exe	rfusclient.exe
PID 4588 wrote to memory of 1944	4588	rfusclient.exe	rfusclient.exe
PID 4588 wrote to memory of 1944	4588	rfusclient.exe	rfusclient.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2052 attrib.exe

pid	process
2052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe
"C:\Users\Admin\AppData\Local\Temp\7a752317f8a8a458efc1765b8b2f5742826a2783ec66250088db87aaacb40aa7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\SysWOW64\chcp.com
chcp 1251
3⤵
PID:628

C:\Windows\SysWOW64\msiexec.exe
MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\SysWOW64\msiexec.exe
MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:456

C:\Windows\SysWOW64\msiexec.exe
MsiExec /I "rms.server5.1b3ru.msi" /qn
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\SysWOW64\attrib.exe
attrib +S +H +r "C:\Program Files\Remote Manipulator System - Server"
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2052

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Installer\Products\85809A11BB0485842AADAC465 95B9E70" /f
3⤵
PID:2724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 768C7F759612A88E42353DD0A046E6A4
2⤵
- Loads dropped DLL
PID:3460

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0C99936259CF74854B3975D7392DCDD3 E Global\MSI0000
2⤵
- Loads dropped DLL
- Modifies registry class
PID:5116

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5052

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4544

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1008

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall
3⤵
- Executes dropped EXE
PID:864

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3800

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start
3⤵
- Executes dropped EXE
PID:564

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
2⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Remote Manipulator System - Server\English.lg
Filesize
33KB

MD5
fb0fb6001e3efdfc29d79e045ada9798

SHA1
fb8fe198211634fa9a52866c8f607bdb6b8a4523

SHA256
7ec3ff20d8ac7514dbdbc861487cc054ba8243d95ee801cfd888ea1e47d5d0ba

SHA512
8e38b464399a6375962eaa671eaca38aed96774586d4b2818fa656e6adc1211ff6612073bec5cd62f167fffea194ed494fb94cf2930a7400a050daff1c37426f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll
Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll
Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll
Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg
Filesize
36KB

MD5
9fd456fab1e052e5aaf75f4025dcd4e6

SHA1
9dc25826bd94382c5a518424bf244c3c4c371c8e

SHA256
d7e01a137cea72824c3011801b618339e8b427d7167751421d6e4d42694ddbed

SHA512
694f003f2bef468d21323a569207949dc0854f094e4e355b851d36b0f7fe6a784c0570a91e127395e406cdd498eb65b58596ecc2b6dc1541aff43ba15ff42a56

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll
Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll
Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll
Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll
Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll
Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll
Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll
Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll
Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll
Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll
Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll
Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll
Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll
Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll
Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd
Filesize
377B

MD5
b039bda29f5ab93e16438b220701b103

SHA1
8945875ba4d034834ad3630cf83346936b5cb9f2

SHA256
ea809d3d96b2c507a068816c3effa648b68cf354e59e63264786bbf997b1fa17

SHA512
4ed2862308be40884df81506eb1cbe325fbb0920518d63f6efd0a240051bb6ae4b044af2cfbf46d48ecfaad0fc5b315a10deb0c2a88d49d0121eb7752997fa50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.server5.1b3ru.msi
Filesize
6.2MB

MD5
136af5bb2413c309ae700bbb37f5458a

SHA1
22427aaef204561e05bffe6bdc0d7b80fc12770a

SHA256
c36dfc2ec402d4670552b04c0bbee2bf721281d366e248f7a85f6693ae60159c

SHA512
1dd47bc6d69327ad92c4fef3f98b252d7e6aa8b87acfb50ea504e30afad3dc64301f0bfd76f75e91b383f9f03d814e55a6d7cf44ca5afa4c1c42ac715ea55141

Download Submit
C:\Users\Admin\AppData\Local\Temp\~398E.tmp
Filesize
1KB

MD5
6177d1d6c3c98c6a693b37860f30ea6b

SHA1
82c5f128489a1a194aaa6db641a2e8cf4e560f5b

SHA256
0903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76

SHA512
fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~398E.tmp
Filesize
1KB

MD5
fb03ea99c80884fc0bfdb084ad6d9b15

SHA1
f4e9b6cc70de0ae5095973b16fdcd192ef792e9b

SHA256
5756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b

SHA512
0d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db

Download Submit
C:\Windows\Installer\MSI38E3.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI38E3.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI3B75.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI3B75.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI3D3B.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI3D3B.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI4C11.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\MSI4C11.tmp
Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
memory/228-138-0x0000000000000000-mapping.dmp

Download
memory/456-137-0x0000000000000000-mapping.dmp

Download
memory/564-187-0x0000000000000000-mapping.dmp

Download
memory/628-134-0x0000000000000000-mapping.dmp

Download
memory/864-180-0x0000000000000000-mapping.dmp

Download
memory/1008-178-0x0000000000000000-mapping.dmp

Download
memory/1196-135-0x0000000000000000-mapping.dmp

Download
memory/1944-202-0x0000000000000000-mapping.dmp

Download
memory/2052-190-0x0000000000000000-mapping.dmp

Download
memory/2340-136-0x0000000000000000-mapping.dmp

Download
memory/2368-199-0x0000000000000000-mapping.dmp

Download
memory/2724-191-0x0000000000000000-mapping.dmp

Download
memory/3460-140-0x0000000000000000-mapping.dmp

Download
memory/3800-182-0x0000000000000000-mapping.dmp

Download
memory/4132-132-0x0000000000000000-mapping.dmp

Download
memory/4544-175-0x0000000000000000-mapping.dmp

Download
memory/4588-198-0x0000000000000000-mapping.dmp

Download
memory/5052-171-0x0000000000000000-mapping.dmp

Download
memory/5116-169-0x0000000002B11000-0x0000000002B9C000-memory.dmp

Filesize
556KB

Download
memory/5116-143-0x0000000000000000-mapping.dmp

Download
memory/5116-152-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/5116-162-0x0000000002B10000-0x0000000002BB3000-memory.dmp

Filesize
652KB

Download
memory/5116-167-0x0000000002B10000-0x0000000002BB3000-memory.dmp

Filesize
652KB

Download
memory/5116-168-0x0000000002B33000-0x0000000002CA9000-memory.dmp

Filesize
1.5MB

Download
memory/5116-170-0x0000000002B11000-0x0000000002B9C000-memory.dmp

Filesize
556KB

Download