Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2023, 08:11
Behavioral task
behavioral1
Sample
installer.exe
Resource
win7-20230220-en
General
-
Target
installer.exe
-
Size
17.2MB
-
MD5
54373b0f78368991613b2de88c88e031
-
SHA1
101a9b7c1d718b4736022a1512339b19595a1249
-
SHA256
3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc
-
SHA512
7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d
-
SSDEEP
393216:DlvZgujNosdXfmSgJeUj6hl8EVlX9/B9hxvefjM5U+Ko/BrzhNwh:D5muFN0JeUj6hl8EVltpTxUjKKULWh
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 17 3852 msiexec.exe 19 3852 msiexec.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETC364.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETC364.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\lockscr.sys DrvInst.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation installer.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation rfusclient.exe -
Executes dropped EXE 10 IoCs
pid Process 1460 rfusclient.exe 4152 rutserv.exe 3444 rutserv.exe 5032 drvinstaller64.exe 1092 rutserv.exe 4452 rutserv.exe 3120 rutserv.exe 4136 rfusclient.exe 3584 rfusclient.exe 652 rfusclient.exe -
Loads dropped DLL 11 IoCs
pid Process 3700 MsiExec.exe 4152 rutserv.exe 4152 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe -
resource yara_rule behavioral2/memory/4176-133-0x0000000000400000-0x000000000283E000-memory.dmp upx behavioral2/memory/4176-149-0x0000000000400000-0x000000000283E000-memory.dmp upx behavioral2/memory/4176-352-0x0000000000400000-0x000000000283E000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7 rutserv.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBF10.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\lockscr.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_b5060323c4b9d7cd\lockscr.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rutserv.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF dxdiag.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\lockscr.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_b5060323c4b9d7cd\lockscr.PNF drvinstaller64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rutserv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\lockscr.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EB35376744F392396307460D546222D_5CEF6F51E318C288850DB2D9275D6665 rutserv.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF dxdiag.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EB35376744F392396307460D546222D_5CEF6F51E318C288850DB2D9275D6665 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7 rutserv.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF dxdiag.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBF11.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2 rutserv.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dxdiag.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBEFF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_b5060323c4b9d7cd\lockscr.cat DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx dxdiag.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2 rutserv.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF dxdiag.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBEFF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBF11.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dxdiag.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{02271c39-4aac-ce4f-aeb8-b06cc7b040ff}\SETBF10.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_b5060323c4b9d7cd\lockscr.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rutserv.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows8\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\drvinstaller64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2023-06.html rutserv.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows8\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows8\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows10\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\drvinstaller32.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x86\Windows8\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows10\lockscr.cat msiexec.exe File opened for modification C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2023-06.html rutserv.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows8\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\Windows10\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe msiexec.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\e569187.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e56918a.msi msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI9E48.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\e569187.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA4A2.tmp msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log drvinstaller64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\SourceHash{E5803A4B-5A4B-44F6-A759-882FB6AD7982} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID drvinstaller64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs drvinstaller64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\Calibration\0\GUID = f03063ce7803ee118001444553540000 dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{0BF0F2B2-C8AC-4390-9873-0CBDCF881972}\CLSID = "{E30629D2-27E5-11CE-875D-00608CB78066}" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rutserv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectX Diagnostic Tool\DxDiag In SystemInfo = "1" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\7CCITT u-Law\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b71000000000000000000000000000000000700000000001000800000aa00389b71 dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Id = "DXDIAG.EXE214A433E00042800" dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{0BF0F2B2-C8AC-4390-9873-0CBDCF881972}\EndpointId = "{0.0.1.00000000}.{0bf0f2b2-c8ac-4390-9873-0cbdcf881972}" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\17IMA ADPCM\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b71000000000000000000000000000000001100000000001000800000aa00389b71 dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\FilterData = 02000000000080000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000006d69647300001000800000aa00389b7100000000000000000000000000000000 dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A762-90C8-11D0-BD43-00A0C911CE86} dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device\DSGuid = "{00000000-0000-0000-0000-000000000000}" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rutserv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\2Microsoft ADPCM\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b71000000000000000000000000000000000200000000001000800000aa00389b71 dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Version = 00080000 dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\1PCM\CLSID = "{6A08CF80-0E18-11CF-A24D-0020AFD79767}" dxdiag.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\1PCM\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b71000000000000000000000000000000000100000000001000800000aa00389b71 dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\DirectSound:{C27E448F-4E64-46BD-9147-D5102EF70FCE}\CLSID = "{79376820-07D0-11CF-A24D-0020AFD79767}" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs drvinstaller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs drvinstaller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dxdiag.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\DirectX Diagnostic Tool\DxDiag In VideoCapture = "1" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople drvinstaller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dxdiag.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\wave:{0BF0F2B2-C8AC-4390-9873-0CBDCF881972}\WaveInId = "0" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default WaveOut Device\FriendlyName = "Default WaveOut Device" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs drvinstaller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\1PCM dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\FriendlyName = "Default MidiOut Device" dxdiag.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\CLSID = "{07B65360-C445-11CE-AFDE-00AA006C14F4}" dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dxdiag.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dxdiag.exe -
Modifies registry class 61 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID dxdiag.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\monitor_driver msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID dxdiag.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\RMS msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductName = "Remote Manipulator System - Host" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RMS_{9A867C19-C39A-4930-8F3C-1F961B9A33A5}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\PackageName = "host.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\PackageCode = "B39B0F2EBB537BF46A58ECBDE554B477" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RMS_{9A867C19-C39A-4930-8F3C-1F961B9A33A5}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove dxdiag.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{6A71FFDA-5C04-4959-B7C5-23CDBD2F733A} dxdiag.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Language = "1049" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7} dxdiag.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Version = "117436076" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductIcon = "C:\\Windows\\Installer\\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\2 = "C:\\ProgramData\\Remote Manipulator System\\msi\\69110_{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b817e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 rutserv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4176 installer.exe 4176 installer.exe 4176 installer.exe 4176 installer.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3584 rfusclient.exe 3584 rfusclient.exe 5112 dxdiag.exe 5112 dxdiag.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 652 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3896 msiexec.exe Token: SeIncreaseQuotaPrivilege 3896 msiexec.exe Token: SeSecurityPrivilege 3852 msiexec.exe Token: SeCreateTokenPrivilege 3896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3896 msiexec.exe Token: SeLockMemoryPrivilege 3896 msiexec.exe Token: SeIncreaseQuotaPrivilege 3896 msiexec.exe Token: SeMachineAccountPrivilege 3896 msiexec.exe Token: SeTcbPrivilege 3896 msiexec.exe Token: SeSecurityPrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeLoadDriverPrivilege 3896 msiexec.exe Token: SeSystemProfilePrivilege 3896 msiexec.exe Token: SeSystemtimePrivilege 3896 msiexec.exe Token: SeProfSingleProcessPrivilege 3896 msiexec.exe Token: SeIncBasePriorityPrivilege 3896 msiexec.exe Token: SeCreatePagefilePrivilege 3896 msiexec.exe Token: SeCreatePermanentPrivilege 3896 msiexec.exe Token: SeBackupPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeShutdownPrivilege 3896 msiexec.exe Token: SeDebugPrivilege 3896 msiexec.exe Token: SeAuditPrivilege 3896 msiexec.exe Token: SeSystemEnvironmentPrivilege 3896 msiexec.exe Token: SeChangeNotifyPrivilege 3896 msiexec.exe Token: SeRemoteShutdownPrivilege 3896 msiexec.exe Token: SeUndockPrivilege 3896 msiexec.exe Token: SeSyncAgentPrivilege 3896 msiexec.exe Token: SeEnableDelegationPrivilege 3896 msiexec.exe Token: SeManageVolumePrivilege 3896 msiexec.exe Token: SeImpersonatePrivilege 3896 msiexec.exe Token: SeCreateGlobalPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe Token: SeRestorePrivilege 3852 msiexec.exe Token: SeTakeOwnershipPrivilege 3852 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4136 rfusclient.exe 4136 rfusclient.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4136 rfusclient.exe 4136 rfusclient.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 4152 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 3444 rutserv.exe 5032 drvinstaller64.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 1092 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 4452 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 3120 rutserv.exe 5112 dxdiag.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3896 4176 installer.exe 84 PID 4176 wrote to memory of 3896 4176 installer.exe 84 PID 4176 wrote to memory of 3896 4176 installer.exe 84 PID 3852 wrote to memory of 3700 3852 msiexec.exe 90 PID 3852 wrote to memory of 3700 3852 msiexec.exe 90 PID 3852 wrote to memory of 3700 3852 msiexec.exe 90 PID 3852 wrote to memory of 1460 3852 msiexec.exe 92 PID 3852 wrote to memory of 1460 3852 msiexec.exe 92 PID 3852 wrote to memory of 1460 3852 msiexec.exe 92 PID 3852 wrote to memory of 4152 3852 msiexec.exe 95 PID 3852 wrote to memory of 4152 3852 msiexec.exe 95 PID 3852 wrote to memory of 4152 3852 msiexec.exe 95 PID 3852 wrote to memory of 3444 3852 msiexec.exe 96 PID 3852 wrote to memory of 3444 3852 msiexec.exe 96 PID 3852 wrote to memory of 3444 3852 msiexec.exe 96 PID 3444 wrote to memory of 5032 3444 rutserv.exe 97 PID 3444 wrote to memory of 5032 3444 rutserv.exe 97 PID 2620 wrote to memory of 3504 2620 svchost.exe 99 PID 2620 wrote to memory of 3504 2620 svchost.exe 99 PID 2620 wrote to memory of 564 2620 svchost.exe 100 PID 2620 wrote to memory of 564 2620 svchost.exe 100 PID 3852 wrote to memory of 1092 3852 msiexec.exe 103 PID 3852 wrote to memory of 1092 3852 msiexec.exe 103 PID 3852 wrote to memory of 1092 3852 msiexec.exe 103 PID 3852 wrote to memory of 4452 3852 msiexec.exe 105 PID 3852 wrote to memory of 4452 3852 msiexec.exe 105 PID 3852 wrote to memory of 4452 3852 msiexec.exe 105 PID 3120 wrote to memory of 3584 3120 rutserv.exe 108 PID 3120 wrote to memory of 3584 3120 rutserv.exe 108 PID 3120 wrote to memory of 3584 3120 rutserv.exe 108 PID 3120 wrote to memory of 4136 3120 rutserv.exe 109 PID 3120 wrote to memory of 4136 3120 rutserv.exe 109 PID 3120 wrote to memory of 4136 3120 rutserv.exe 109 PID 3584 wrote to memory of 652 3584 rfusclient.exe 110 PID 3584 wrote to memory of 652 3584 rfusclient.exe 110 PID 3584 wrote to memory of 652 3584 rfusclient.exe 110 PID 3120 wrote to memory of 5112 3120 rutserv.exe 111 PID 3120 wrote to memory of 5112 3120 rutserv.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RMS_{9A867C19-C39A-4930-8F3C-1F961B9A33A5}\host.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6BB2CB2BBECDF32168863AA1121921DC2⤵
- Loads dropped DLL
PID:3700
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RMS_{9A867C19-C39A-4930-8F3C-1F961B9A33A5}\host.msi"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1460
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4152
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -dispinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\drvinstaller64.exe"C:\Program Files (x86)\Remote Manipulator System - Host\Monitor\x64\drvinstaller64.exe" -dispinstall3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5032
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4452
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files (x86)\remote manipulator system - host\monitor\x64\windows10\lockscr.inf" "9" "4351f1d4b" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\remote manipulator system - host\monitor\x64\windows10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3504
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "DISPLAY\RHT1234\4&27B1E55B&0&UID0" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca116f85e4ac:Driver_DDI:16.10.46.576:*pnp09ff," "4351f1d4b" "0000000000000154"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:564
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:652
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4136
-
-
C:\Windows\system32\dxdiag.exe"C:\Windows\system32\dxdiag.exe" /whql:off /x "C:\Windows\Temp\dxdig_{851BB3E3-3558-43C6-AF60-A4A587A2A46F}.xml"2⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5e4c0cbcef2fc4e7fb8c6e635651d344d
SHA1fa49463e885b8c898a8fec1780f6a5a06b32a08e
SHA256260843f81d4961c6ff71eb82781950ab101b303311e9402a1cc2c72c2b7d8e42
SHA5120b717264157ecee9887fc00c763b492436b56789b2509edbc46f9045cb202f9618a60733e7454163996c9f80f1531ab9006a9fa97c69346bb5e096b4ddea3c5a
-
Filesize
58KB
MD5246286feb0ed55eaf4251e256d2fe47e
SHA1bc76b013918e4c1bd6dff44708a760496d8c717c
SHA25664c70065830cc623be55c73a940aa3da57c134ee459afbd983ff17960dc57c27
SHA512900e670259fb3b5762c0242236ce86fcdd04300407fc4d79959edfed99bbec58b4e10048a2b9ef54e709d00717870bf09c7b5fb2f5fa3cfe844682d2bb36f12f
-
Filesize
335KB
MD572076f4aae15dd34c572e8e151c261e6
SHA14c9a495e24a3d2d95f89b6b9bf908de3e7b82928
SHA256588e5a448742a6bbe8536463b072a424ca3e7a88a212d7fa92618b2620826db6
SHA5127ad67ca63a84b4977b98ad26922154aad798e8518e93a8c57bb5f0803e96252fe6c8646d6dad53dc81abdbed114b16d4e25beeae7050ab835f38b7ece7472572
-
Filesize
335KB
MD572076f4aae15dd34c572e8e151c261e6
SHA14c9a495e24a3d2d95f89b6b9bf908de3e7b82928
SHA256588e5a448742a6bbe8536463b072a424ca3e7a88a212d7fa92618b2620826db6
SHA5127ad67ca63a84b4977b98ad26922154aad798e8518e93a8c57bb5f0803e96252fe6c8646d6dad53dc81abdbed114b16d4e25beeae7050ab835f38b7ece7472572
-
Filesize
64KB
MD555a0b95a1d1b7e309f2c22af82a07cc0
SHA1521c41e185e5b5e73cfc4e1b18646dc4ed171942
SHA256704a1a83d11c21717c17e6a7eb264d94a98d45a7c1aba8ebb82fafc65f4f199d
SHA51238e3a8392f84cd31b9eb12ce4fa7ed04db29f4fe4de95e52f18cdc6e7c74a0b2673d15ab40802bf289ed3a1e83526827b012ceddbb309f40c5302547ce39f5f9
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
6.3MB
MD5cd97f125a6462574065fd1e3854f9d7f
SHA1fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f
SHA256b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2
SHA5125f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24
-
Filesize
6.3MB
MD5cd97f125a6462574065fd1e3854f9d7f
SHA1fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f
SHA256b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2
SHA5125f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24
-
Filesize
6.3MB
MD5cd97f125a6462574065fd1e3854f9d7f
SHA1fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f
SHA256b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2
SHA5125f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24
-
Filesize
6.3MB
MD5cd97f125a6462574065fd1e3854f9d7f
SHA1fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f
SHA256b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2
SHA5125f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24
-
Filesize
6.3MB
MD5cd97f125a6462574065fd1e3854f9d7f
SHA1fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f
SHA256b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2
SHA5125f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
12.6MB
MD555d66bd554511f803bebead2bd1bfde0
SHA134d8176565909b7b756d92a32cd8a50185f998f1
SHA256decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd
SHA512cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
380KB
MD51ea62293ac757a0c2b64e632f30db636
SHA18c8ac6f8f28f432a514c3a43ea50c90daf66bfba
SHA256970cb3e00fa68daec266cd0aa6149d3604cb696853772f20ad67555a2114d5df
SHA512857872a260cd590bd533b5d72e6e830bb0e4e037cb6749bb7d6e1239297f21606cdbe4a0fb1492cdead6f46c88dd9eb6fab5c6e17029f7df5231cefc21fa35ab
-
Filesize
1.6MB
MD589770647609ac26c1bbd9cf6ed50954e
SHA1349eed120070bab7e96272697b39e786423ac1d3
SHA2567b4fc8e104914cdd6a7bf3f05c0d7197cfcd30a741cc0856155f2c74e62005a4
SHA512a98688f1c80ca79ee8d15d680a61420ffb49f55607fa25711925735d0e8dbc21f3b13d470f22e0829c72a66a798eee163411b2f078113ad8153eed98ef37a2cc
-
Filesize
260KB
MD5d29f7070ee379544aeb19913621c88e6
SHA1499dcdb39862fd8ff5cbc4b13da9c465bfd5f4be
SHA256654f43108fbd56bd2a3c5a3a74a2ff3f19ea9e670613b92a624e86747a496caf
SHA5124ead1c8e0d33f2a6c35163c42e8f0630954de67e63bcadca003691635ccf8bfe709363ec88edb387b956535fdb476bc0b5773ede5b19cacf4858fb50072bbef5
-
Filesize
365KB
MD57a9eeac3ceaf7f95f44eb5c57b4db2e3
SHA1be1048c254aa3114358f76d08c55667c4bf2d382
SHA256b497d07ed995b16d1146209158d3b90d85c47a643fbf25a5158b26d75c478c88
SHA512b68fa132c3588637d62a1c2bce8f8acc78e6e2f904a53644d732dc0f4e4fbc61a2829a1ac8f6b97fe4be4f3613ef92c43e6f2ab29c6abd968acc5acd635c990d
-
Filesize
860KB
MD55308b9945e348fbe3a480be06885434c
SHA15c3cb39686cca3e9586e4b405fc8e1853caaf8ff
SHA2569dc30fb2118aad48f6a5e0a82504f365fe40abb3134f6cceeb65859f61ad939a
SHA5124d7f08dc738a944bcee9b013b13d595e9c913b248c42a6c095cbdfc6059da7f04cca935841ff8a43687b75bdc5af05e888241e52ef594aa752ba9425cf966412
-
Filesize
504B
MD55690d40471020d33903f56393184ae24
SHA1ca0d4329447e7cd9c5a8848dbb9dcff3598fafe1
SHA256aaec017f37de54055920a04474e9ada459cf52a83cb628a75f4cbe463f9b4add
SHA5127d7a0658e37dcda9d5bac3fb782514c4850f02d25dcd21623d6e5789d6375dc0e0c150c784434289473af876cadd5aeba652858b1c810018d95265c5cd99c27b
-
Filesize
710B
MD52099496c2594826c66a3f0811be055d2
SHA197429372b2c17c688e8e0e8536283d9666284dcc
SHA2563a5546663d5930fac8f35fc068fdf6c7a4b0d0424f207aad9ab6dd26de94c815
SHA5121781eb10b3a7d4d7830dda56abb5b0094e0d2e2169d44ac297fdbdac6edcf162f518e6101a4acd41e09e60ce7539b794d1d26f3496dae92a184fa30ee630f6fe
-
Filesize
17.4MB
MD5bac7724f2bb43c352494c77bc99d3e5c
SHA1f440a950e53adad76238db2e084374fc74a5711b
SHA256a5a34195a4db94f212535d5182a044d74fe67b31a3e50d7d26148e6d1a103793
SHA5121e7e85915293db5c9ee9dc27604d1f9c83ad66aec28aa82544d29f2ee4ffca72349c0b828a17fe1b08fab206b3695ce7072227ded23bb315db6f663e93427b1d
-
Filesize
1KB
MD549ad0d7c46ac85407b40701d0d205aa8
SHA1d1a359d7aacfa04424bdda9ba49c81eb248799e3
SHA256ca1ff261a0884cb5e9203ef6e2ccc67be6bad06c8af705cb2a17d717ecd6207a
SHA5124fffa5ad19c2d4f29ff410f00fbed2f411e93a4941cd2c17deafb62cf08b2ddd18af7a6b88e8ba28524bc4ca05cea432c873058d93dcb24cabaf1f1bdc0c469d
-
Filesize
153KB
MD552185b209cfdb02d88b4a40a4bdf0911
SHA1aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA256756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
SHA5128493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
-
Filesize
153KB
MD552185b209cfdb02d88b4a40a4bdf0911
SHA1aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA256756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
SHA5128493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
-
Filesize
17.4MB
MD5bac7724f2bb43c352494c77bc99d3e5c
SHA1f440a950e53adad76238db2e084374fc74a5711b
SHA256a5a34195a4db94f212535d5182a044d74fe67b31a3e50d7d26148e6d1a103793
SHA5121e7e85915293db5c9ee9dc27604d1f9c83ad66aec28aa82544d29f2ee4ffca72349c0b828a17fe1b08fab206b3695ce7072227ded23bb315db6f663e93427b1d
-
Filesize
23KB
MD532870cbf933826df5160b176b54293e6
SHA1367afde56b570dc5cb0ea9387749fe793a4ababd
SHA256486ddc8e9aa5b4e5cd166c5b326edfd682554c10ff0f31eb2feaaa2e479f5389
SHA5128405045707a4d6a17004c904aa5d6ecc448cadcd339bf8f7acea2fa91d29b02378ec158321c3e8450a958345ba96ed385a19e19fd15189fa2c15dd5a5d1ae682
-
Filesize
7KB
MD5ee9324c580306d44cd07af5784f57f3a
SHA187459b660ff1f3e753baf79ef3d802897cd6d2ef
SHA256d5fb65a1c62fdeac55ee128285ce0f9bb6db53b7bc00d6b4a0ad7b3d20b17f6b
SHA512d4aed72d7c69a519f8bbdaacaf4c788c69b65a0f40fdab4068d32ffcbdbacd4f5dc89e365cf3a7815b2afc6f6036ba2f2bc2c2d3cea727f4357de98b5b012a67
-
Filesize
1KB
MD549ad0d7c46ac85407b40701d0d205aa8
SHA1d1a359d7aacfa04424bdda9ba49c81eb248799e3
SHA256ca1ff261a0884cb5e9203ef6e2ccc67be6bad06c8af705cb2a17d717ecd6207a
SHA5124fffa5ad19c2d4f29ff410f00fbed2f411e93a4941cd2c17deafb62cf08b2ddd18af7a6b88e8ba28524bc4ca05cea432c873058d93dcb24cabaf1f1bdc0c469d
-
Filesize
150KB
MD54fc00c6118f86008809259fe0ef599b7
SHA192ee1837383344c69727f6e61e1189dec79ee164
SHA2568898ca28429861a6a9074641b923ba42cfcdb63196eb674830173e777a78698f
SHA512710a8975ba7b250a4178028e142b3e674c37ad9eb09d39821944385d32b60edd119872f39974649468b363a4675a222c6a8b2dd4ae5691825b92ed333d45eb1f
-
Filesize
64KB
MD5d2404c9a812bfc58d3bc6e61b7bf3631
SHA158bc9ac90928e9feb67dbe6d05bce3888fcda228
SHA256588772174b6dcda5935aee75e5231b4413e6bbe9c96ae540dadd67407a5b1606
SHA5123fe92085cb91816e0d7ce7bb4c7fc4e3f3e8e700459d5f9c21889489e65e6e37cd44920dcdf8cbcaf8bafc5bf56479307191ba3f0e2e15cc7593e4df82d47cfb
-
Filesize
89KB
MD5ce4230bc9e0a820f51a595f174795fab
SHA1f7e7ccf69632b36300881ae9e1547640230eec09
SHA2565f9999704d2959b99a771625bcf0915312855c8457a8728d32e99479ca9c6b45
SHA5126b2c6ae923e30186445add98552cd34f44ddcf943b512599e909e06b4f9d9a53424e09c24e0a90da3ac177bebe3b4fdd3db64cef5af5d284f6f7c4f35d361000
-
Filesize
131KB
MD50c67b7e5cc11746e8bfe616eb97df03e
SHA1478a73a705f17ddd4896f7a36d2275d68e34dbb6
SHA2564788f23fcc4131f645d69620053da86508e5d6f9eec38bf89c49e508d053e259
SHA51245bdc346c3b9e8181f3a49ef4a567dd5a06332aa0e0f5820e6946b3f07a3407587f008b8a9a7fd9a15f14ae333ec4081ec9ff745ce1691f6c841070e120227d4
-
Filesize
10KB
MD512a7f47c90e918b41ce04c9bcb51359a
SHA133aed70fa4741248d38f9470bab68fc67feb970c
SHA2564e7afd7f1ee3926742d10502879576e3dfe132c558c9c3c833df715a49fa2f3a
SHA51232620cdc862beb166aecd3622457c311b28bf447c1fe83bf546aa507bf2cf6a1911da881d6c4e655df7d38617a67c535af7e36ac1021ada9b97e0b6623a48733
-
Filesize
1KB
MD549ad0d7c46ac85407b40701d0d205aa8
SHA1d1a359d7aacfa04424bdda9ba49c81eb248799e3
SHA256ca1ff261a0884cb5e9203ef6e2ccc67be6bad06c8af705cb2a17d717ecd6207a
SHA5124fffa5ad19c2d4f29ff410f00fbed2f411e93a4941cd2c17deafb62cf08b2ddd18af7a6b88e8ba28524bc4ca05cea432c873058d93dcb24cabaf1f1bdc0c469d
-
Filesize
23KB
MD532870cbf933826df5160b176b54293e6
SHA1367afde56b570dc5cb0ea9387749fe793a4ababd
SHA256486ddc8e9aa5b4e5cd166c5b326edfd682554c10ff0f31eb2feaaa2e479f5389
SHA5128405045707a4d6a17004c904aa5d6ecc448cadcd339bf8f7acea2fa91d29b02378ec158321c3e8450a958345ba96ed385a19e19fd15189fa2c15dd5a5d1ae682
-
Filesize
65KB
MD5f2628277cf15d28c3e1d1505583b3a12
SHA10463fe554329f694c1222b36bd0f50ad9235b4c5
SHA256b32f9f5ee680cd3f345ac98c752bbc6dceb9c65bf86d3f9fb85f5bbb1deddf72
SHA51202460fb6601fe295328e7b8c304ce6ab7062527ee60b6dc555e5c6248d33d5a9359244559d738acdd7a87671241a55814e754ec222ac1ad2a57445a70ade601e
-
Filesize
23KB
MD532870cbf933826df5160b176b54293e6
SHA1367afde56b570dc5cb0ea9387749fe793a4ababd
SHA256486ddc8e9aa5b4e5cd166c5b326edfd682554c10ff0f31eb2feaaa2e479f5389
SHA5128405045707a4d6a17004c904aa5d6ecc448cadcd339bf8f7acea2fa91d29b02378ec158321c3e8450a958345ba96ed385a19e19fd15189fa2c15dd5a5d1ae682
-
Filesize
10KB
MD512a7f47c90e918b41ce04c9bcb51359a
SHA133aed70fa4741248d38f9470bab68fc67feb970c
SHA2564e7afd7f1ee3926742d10502879576e3dfe132c558c9c3c833df715a49fa2f3a
SHA51232620cdc862beb166aecd3622457c311b28bf447c1fe83bf546aa507bf2cf6a1911da881d6c4e655df7d38617a67c535af7e36ac1021ada9b97e0b6623a48733
-
Filesize
1KB
MD549ad0d7c46ac85407b40701d0d205aa8
SHA1d1a359d7aacfa04424bdda9ba49c81eb248799e3
SHA256ca1ff261a0884cb5e9203ef6e2ccc67be6bad06c8af705cb2a17d717ecd6207a
SHA5124fffa5ad19c2d4f29ff410f00fbed2f411e93a4941cd2c17deafb62cf08b2ddd18af7a6b88e8ba28524bc4ca05cea432c873058d93dcb24cabaf1f1bdc0c469d