rms | d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
Size

5.0MB
MD5

723a7e3f2a293f526c2574cfad06b72b
SHA1

54c9a81aa53962beb066402e63464f7b18d34273
SHA256

d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec
SHA512

a4183af1435af07da77d96ca992190d06d5c5bda37528a5c5a4aeb811aedaa6c26ebaa7d26347d066d92ce60f11e2c893b5ed0526e71daebd8d65aca2afdc70b
SSDEEP

98304:YogY3IgMAk7BepFZXiWDoFA9hvfbDU+epbQ9DgG6O2kF2KaQ+02usPfdN:YS3IRRwp/Xi+KAjffU+epbytUkF9aQ+V

Score

10^/10

rms discovery rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 7 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid process

3044 rutserv.exe
2908 rutserv.exe
2748 rutserv.exe
2936 rutserv.exe
1440 rfusclient.exe
1620 rfusclient.exe
1632 rfusclient.exe
Loads dropped DLL 2 IoCs

Processes:

MsiExec.exerutserv.exe

pid process

2456 MsiExec.exe
2936 rutserv.exe
Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

27 2992 msiexec.exe
37 2992 msiexec.exe
39 2992 msiexec.exe
43 2992 msiexec.exe

pid	process
3044	rutserv.exe
2908	rutserv.exe
2748	rutserv.exe
2936	rutserv.exe
1440	rfusclient.exe
1620	rfusclient.exe
1632	rfusclient.exe

pid	process
2456	MsiExec.exe
2936	rutserv.exe

flow	pid	process
27	2992	msiexec.exe
37	2992	msiexec.exe
39	2992	msiexec.exe
43	2992	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description ioc process

File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe
File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe

description	ioc	process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 17 IoCs

Processes:

msiexec.exerutserv.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html	rutserv.exe

Drops file in Windows directory 18 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7D0.tmp	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File created	C:\Windows\Installer\f76d1ff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d1ff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d202.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID639.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File created	C:\Windows\Installer\f76d202.ipi	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File created	C:\Windows\Installer\f76d204.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rutserv.exerutserv.exe723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exemsiexec.exemsiexec.exerutserv.exerfusclient.execmd.exePING.EXEmsiexec.exeMsiExec.exeIEXPLORE.EXEchcp.comrutserv.exerfusclient.exerfusclient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

2640 PING.EXE

pid	process
2640	PING.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "972"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "102"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "972"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "147"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ECB09D1-4AF8-11EF-9BD3-424588269AE0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "1031"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "59"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "102"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "116"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "39"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "39"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "59"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "12"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "87"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "972"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "147"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "12"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\ = "59"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "1031"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "9"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "39"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\rmansys.ru\Total = "102"	IEXPLORE.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF\Remote_Office_Manager	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Version = "100600760"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductIcon = "C:\\Windows\\Installer\\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\PackageCode = "3041FA689ACC3184E99A4B5081B5660B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\PackageName = "rms.host5.3ru.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\1 = "DISK1;1"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2640 PING.EXE

pid	process
2640	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

msiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	process
2992	msiexec.exe
2992	msiexec.exe
3044	rutserv.exe
3044	rutserv.exe
2908	rutserv.exe
2908	rutserv.exe
2748	rutserv.exe
2748	rutserv.exe
2936	rutserv.exe
2936	rutserv.exe
2936	rutserv.exe
2936	rutserv.exe
1440	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

1632 rfusclient.exe

pid	process
1632	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2844	msiexec.exe
Token: SeRestorePrivilege	2992	msiexec.exe
Token: SeTakeOwnershipPrivilege	2992	msiexec.exe
Token: SeSecurityPrivilege	2992	msiexec.exe
Token: SeCreateTokenPrivilege	2844	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2844	msiexec.exe
Token: SeLockMemoryPrivilege	2844	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2844	msiexec.exe
Token: SeMachineAccountPrivilege	2844	msiexec.exe
Token: SeTcbPrivilege	2844	msiexec.exe
Token: SeSecurityPrivilege	2844	msiexec.exe
Token: SeTakeOwnershipPrivilege	2844	msiexec.exe
Token: SeLoadDriverPrivilege	2844	msiexec.exe
Token: SeSystemProfilePrivilege	2844	msiexec.exe
Token: SeSystemtimePrivilege	2844	msiexec.exe
Token: SeProfSingleProcessPrivilege	2844	msiexec.exe
Token: SeIncBasePriorityPrivilege	2844	msiexec.exe
Token: SeCreatePagefilePrivilege	2844	msiexec.exe
Token: SeCreatePermanentPrivilege	2844	msiexec.exe
Token: SeBackupPrivilege	2844	msiexec.exe
Token: SeRestorePrivilege	2844	msiexec.exe
Token: SeShutdownPrivilege	2844	msiexec.exe
Token: SeDebugPrivilege	2844	msiexec.exe
Token: SeAuditPrivilege	2844	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2844	msiexec.exe
Token: SeChangeNotifyPrivilege	2844	msiexec.exe
Token: SeRemoteShutdownPrivilege	2844	msiexec.exe
Token: SeUndockPrivilege	2844	msiexec.exe
Token: SeSyncAgentPrivilege	2844	msiexec.exe
Token: SeEnableDelegationPrivilege	2844	msiexec.exe
Token: SeManageVolumePrivilege	2844	msiexec.exe
Token: SeImpersonatePrivilege	2844	msiexec.exe
Token: SeCreateGlobalPrivilege	2844	msiexec.exe
Token: SeShutdownPrivilege	2868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2868	msiexec.exe
Token: SeCreateTokenPrivilege	2868	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2868	msiexec.exe
Token: SeLockMemoryPrivilege	2868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2868	msiexec.exe
Token: SeMachineAccountPrivilege	2868	msiexec.exe
Token: SeTcbPrivilege	2868	msiexec.exe
Token: SeSecurityPrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeLoadDriverPrivilege	2868	msiexec.exe
Token: SeSystemProfilePrivilege	2868	msiexec.exe
Token: SeSystemtimePrivilege	2868	msiexec.exe
Token: SeProfSingleProcessPrivilege	2868	msiexec.exe
Token: SeIncBasePriorityPrivilege	2868	msiexec.exe
Token: SeCreatePagefilePrivilege	2868	msiexec.exe
Token: SeCreatePermanentPrivilege	2868	msiexec.exe
Token: SeBackupPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeShutdownPrivilege	2868	msiexec.exe
Token: SeDebugPrivilege	2868	msiexec.exe
Token: SeAuditPrivilege	2868	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2868	msiexec.exe
Token: SeChangeNotifyPrivilege	2868	msiexec.exe
Token: SeRemoteShutdownPrivilege	2868	msiexec.exe
Token: SeUndockPrivilege	2868	msiexec.exe
Token: SeSyncAgentPrivilege	2868	msiexec.exe
Token: SeEnableDelegationPrivilege	2868	msiexec.exe
Token: SeManageVolumePrivilege	2868	msiexec.exe
Token: SeImpersonatePrivilege	2868	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

iexplore.exemsiexec.exemsiexec.exerfusclient.exe

pid	process
3056	iexplore.exe
2844	msiexec.exe
2844	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

rfusclient.exe

pid process

1620 rfusclient.exe
1620 rfusclient.exe
1620 rfusclient.exe
1620 rfusclient.exe
1620 rfusclient.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3056 iexplore.exe
3056 iexplore.exe
2296 IEXPLORE.EXE
2296 IEXPLORE.EXE
2296 IEXPLORE.EXE
2296 IEXPLORE.EXE

pid	process
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe
1620	rfusclient.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exeiexplore.execmd.exemsiexec.exerutserv.exe

description	pid	process	target process
PID 3032 wrote to memory of 3056	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	iexplore.exe
PID 3032 wrote to memory of 3056	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	iexplore.exe
PID 3032 wrote to memory of 3056	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	iexplore.exe
PID 3032 wrote to memory of 3056	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	iexplore.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3032 wrote to memory of 2432	3032	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	cmd.exe
PID 3056 wrote to memory of 2296	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2296	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2296	3056	iexplore.exe	IEXPLORE.EXE
PID 3056 wrote to memory of 2296	3056	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 2996	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2996	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2996	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2996	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2844	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2868	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2640	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 2640	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 2640	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 2640	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2432 wrote to memory of 2436	2432	cmd.exe	msiexec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 2456	2992	msiexec.exe	MsiExec.exe
PID 2992 wrote to memory of 3044	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 3044	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 3044	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 3044	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2908	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2908	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2908	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2908	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2748	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2748	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2748	2992	msiexec.exe	rutserv.exe
PID 2992 wrote to memory of 2748	2992	msiexec.exe	rutserv.exe
PID 2936 wrote to memory of 1440	2936	rutserv.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://rmansys.ru/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2844
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {B04BFE4C-7F11-49D8-ADFE-867939D886FA} /passive REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2868
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2640
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "rms.host5.3ru.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EFC0EDDD915F58634B14351DCA3867D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2456
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:1632
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76d203.rbs

Filesize
14KB

MD5
673d406578c4593cc786a165a28199f8

SHA1
a455b5cb64f8e4149e03e36a51785dc39dbc5ee9

SHA256
1542bef6cf03f9db3dd2bf518d67b4302583a0b11f3884a1d5015000b04527ba

SHA512
5aa8bc125f006b0d3fac0e70cbff46cd5cb0a14298ecf2db480b9f1b2581940a2e282104e4336943540256af2b265594e6cbd6bdf90dcd8e42338a0c385ddfa1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
42KB

MD5
1239f13726dd9ed2741688b28bec9c01

SHA1
f960677a139da7d7c758330510b43028377a9bf7

SHA256
5572df7bedc2b0d0812643af2c8ee03eaba744df3f01940207122426d2a21339

SHA512
89835f0d6a7453c25432e0d7f0072b9c89558bd567ac81cfa726cf638598e07b282e8df17f5068bcfe54843a696463a0276a9bb68cdb0daabce563f9a2a45ad5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
144KB

MD5
30e269f850baf6ca25187815912e21c5

SHA1
eb160de97d12b4e96f350dd0d0126d41d658afb3

SHA256
379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90

SHA512
9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
357KB

MD5
bb1f3e716d12734d1d2d9219a3979a62

SHA1
0ef66eed2f2ae45ec2d478902833b830334109cb

SHA256
d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077

SHA512
bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
47KB

MD5
83d34dbe5ec48888b06d471ee12ab9fe

SHA1
4c6d12ac5a4d3f668b3e58d02d69b0af6559fb47

SHA256
d2fe39c745748bf73f16367893d6ce4329dc68a68e6c79acc0ed0a240300a936

SHA512
ddce22974a5bfe4ee32d100b05d4b01661e0e51e6e5b27595220a3edac2aa31d90b5389cb33cd492e38126732eac247664b8d93f883399d73f84e6858affec4d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
3.9MB

MD5
8887cd8cf57b949ecc28a28eff53be4d

SHA1
03e2f01ae0342257f743f354e331a527356a3048

SHA256
6784ad757bc2ffd189a11dfb627ea43596b4ad66a62217a5e22f509bdb4bd09d

SHA512
3e784a7bd945b077ea955ec3419361c9a757865750b520ab3e99cab2660120c4b27ed1b0b29e4566788eba46fd5a2d72be4c6972611f8ae3528d840eb60fb415

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.1MB

MD5
38daaf395100a422806f0c7398fe5142

SHA1
493b0f2f9e2af05698ef9862bcef49f40cca8be4

SHA256
7cdc4543bf05da7c2f25048169c338035dec83155ead1d7d08ebb13a1e34f032

SHA512
892dc4647d7a3f2d67d9b32905a3dfbf729145320cf8384ecd32e3ead4f42563c0b0a94a6086fd23e0850999ec7276f4037a7285804ed8ec224467e3cb591c0d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18fa1e1304bde15d638f7e5e8f138716

SHA1
f62b6c0236a63fb90dcbf4cbf14f3b12a3be6ca6

SHA256
4a70cee373f624bd3731aa7b4b99d36be7a116e9f25bb871ff22c6b5ce32943a

SHA512
3933894158412e68b02989b6b6dfb0d7027c687f8a9722699bda8ff00bb0d9d07f8771abafa4070557eb45b9f4396e18c00f260efbc83ad71bce251faa9b3fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a956bcfbf97f985ff64d79b93ee4db6

SHA1
2bad2fec376ea9b896161aa00d81028f70a4eeee

SHA256
99a2db5e0583989284b5d8463e002834b9545aaec429e2505c8163071199f18a

SHA512
d64aa480937d64cd95e52b036ebeb730b6b7fd187726134392ce8d96ac31a5075980495aac4e65776ae55a34a04c593e94e5f376172b738a1f7a3eb9a1fbaf8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10071c993aeafd40d1a2e85fbbf8542b

SHA1
ce9b0f99ae3f88432079b6f905284a2a330ec527

SHA256
dc081a59ef7a92148730cba63f30409d7ecea38c3e58f62e7cec7e4961b28612

SHA512
b17d1dde3bfbd5daad95b69b8275a73dfce567475d41c37824e726ea0f71563208f1e98a3ded0fb56351e4790d928c5d8cb9ae8c0f2db07d6e915ba6ea087406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f92c496105e207473aca9f8196f795

SHA1
6f8d4bab9af6f7e926af982a60d9755c13a086f3

SHA256
51077c286005850583843d85d68c3a685b8755b0da4ec3efa64f66b58a4264b3

SHA512
84a0b0aa7b354f5192f3eb6386af61635fe19b7499ef9c94530922852d73c0bc1925c4b8f0e2de2debe5ac9c448da3f7150ee909966bd53f67eab74ba70db8d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e65c06edb18d37d273866b373a1bd26a

SHA1
958105456e1e236e3255df6bd433b03aae335ca8

SHA256
0f02c3393f56fee61585be09a282257fc17df362c801c8001a700f6577685328

SHA512
63e66127c4fbc4e1cc9e019db91e042e61286620731c517542033ad9312f79ef62015cc68cadb180da4422e5ab2f53a6e2ab1e6518bbcdfd64f7fd9d59dd4b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a648d862d871494c05222db1acad414

SHA1
1292b58c877faacde1d3985c969f69bb2fe76db6

SHA256
846417c872c3ba914f5d4fec46d8c686f3941516e9227ebde93c3e59eabf94d5

SHA512
2a733006b38cddabab461183731da3c0c6723d4298af462282ef34dcf18054e65ec359715f4b3998bd30465f53f19480fe1cd58f739cd5a026629d263f6e8de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
345c72df372553ff2f1f754b13ed8ae7

SHA1
be5f3386053b62954a15d1918779f3c431ce7e9d

SHA256
9ab70831899856db79156776c0bbbd7ac20f0b82216265ae64b93ed6350ff4bc

SHA512
920d57edb08db4efbc23ee99a86bcbf283acab52dd3762240daf114ecb92243ec346f9f7c9f99dffcc0303cfb15d09dc409ac51576e90ef4d44d564a51ff3771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8b3cb227134c1a8c7593e5060bf5847

SHA1
d8fd9fcef8f4a2dab32408b56e5610be6af46a27

SHA256
9ba8af618578280d0cdb4234f5054ee385785724cf17bbc2b4bd3fd99a2e2362

SHA512
4444b1a3a4006cd10e2b97b0d1b86f05fa28554acd2f9b581d281723b78078feb71146bac21eaaf2d26776ede0ffda30e79ad0b81b3420b28252c9cffb2004e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3444dbd802328f257bffbe4024c5ce

SHA1
1820ef986b3c1ff6c1323b6208e8b8a0f8b0e43a

SHA256
4326092d6803b8e5084aede4fcd80684de867c1a50120de482762311825125d4

SHA512
41bfe3ce95715394cf98017e386984c9ed9309b130370434419cf6a025b52a7a9e5e0d9fda734988d1a0e4d404dda06246b5d923e4cae7921b1762ce028c72d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
019e81c49908ba69ffce96837cc02bd0

SHA1
7c16e969a283b390bb6c61673d4c6f50741dd9fb

SHA256
543eeebccf58cfa339050a41b099e0f389223b7c13c66b8ff433c177dcc0960f

SHA512
51f26e3789b4cd046053a29af8933a17624f287e87ca577502469f1c71910991be2528a37dbc2bae3c06bcf4d850bb875b144d281f5a499b5f74448ea1902251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcefcb128ab7f477a6d7fc4f8801bcc8

SHA1
e5579950561aee1219c6d54ff80f285421717c00

SHA256
bc43fdb25a6f9cfaab432a736bd00a46725390729103243e9d380d23f1bd44a7

SHA512
c6f35d0617044f59829af34e790d947f87e3e2447fe5bee4dc5f6c3072ac640e29d4516799252ad15cee0a059014230ff3918ffb3e8325e31859b281660cd672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
995c1b3f15f4ad7697e90c1f030be089

SHA1
6b8746f984eff7899656d17df3b8c959af243228

SHA256
92ea5df3e493eff64dceaaca0c4eb85839ff865dc44c01c80335568efa0a20d3

SHA512
e1af50d2f71eb318dfbdcdb4330d7b8e1e6050d81a8e375711e9db465152a7284e98cef20c349731118abf1f0cd9500cb3eb5875ebeea7bbe4aef4e441d7a202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d630425b39af10796d7d344f72b9e9b

SHA1
3edc53c344c1449d56ad3b974aef16d43ad6d822

SHA256
56470ecf37a4a47f87081d202330a5c6a1c4581966c5d334edb1f80e3a2387cd

SHA512
bee5dd545c8b0577dffaece63d2c0743fe97b7ccb209fa75d67375b60279db2a51686c3c57ffe6ad2d5c9ca51cd6923a0d3cffbdb8697ceda662ea09ad407121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f3c43355359d7da1f142e553c81401

SHA1
d2503edcf5f2788ed96e0840450afaedb6fadce7

SHA256
a9d901aac683eea17867df05fa7089f3243a47f0eb9386f79e4ceb1d039930a6

SHA512
1b4dc31dc38039d8b579483cb830364e51b9d306d9e0257b832aeabfc5302cfe02884a1f4471f4fd306e55bee2234422c72964fd027062b3fbc3d3a61a0ca57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81f3eebcff9d771c02484f9c051c049a

SHA1
4fa6a515e117d866b5a333b7bae33e56c4f59627

SHA256
7f6b060e10458f3130a56bff3b6703ee51480ea1ec600162bd16e4a52b781479

SHA512
c87235e03a8ef35d53352ec7f9641956c38bf26adf8432921e5d6eeced77e2fe078dcdb12ec5bc45b17a1fdea2c6e48b52d9ab0ea8677727625549e3e8add49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0429c09aee139b415f339385d472c723

SHA1
4dc978fae1f506cb7aea2ade1f007fc656b48339

SHA256
c3b971f81a9ce9c5659161e05ed50787b9f5c7a19ddd438cd62a0a9b38ca64d4

SHA512
925c7a850fbc961bb47b9d4d893e0ee74451a0bd7492c9260a66adb7baa7e68eca48879c605bc860f9d619dfe41e1bf9d81e70fbcfa9ad16591084bf3e8ddad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f27712d205e7d6696f901dfdbab34253

SHA1
cd03fddc995898cb637372abcc63b5ccfeeb9037

SHA256
761e36ad4c12779161612d84fc79246b79e82c2db2607255655c7df165bcacc0

SHA512
c1329d5603c34428fd040b9da96d07ada75af688e6008939d704e0d2f0dad0c1bb8ed833d3328a6c9d384afad17023695f85bf6dd67443a16b81f242c52d0adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a631e4313d6d90c8bc9541bde26c91c

SHA1
b8ba979953a0c3ed345ef84c5eae3a3b7014e4ba

SHA256
351d9b66136c6e9bb82c578933d2b8003dc824a4786b7e597dc17523cafb7c44

SHA512
9a33c47550d41353db6371ff818906aa711e75b0624e50915d8b0c52ebcf26f1d84c6a2ebf9fad43fadd8e35042f2c9769f846ee8f5acb4f433dfff93114e06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66d1c42476fc3a4d0e866db509eda6be

SHA1
f2d46d08dde8d8ee47e810bdf5300e73409640ec

SHA256
474aab5a5fbc824b761feba851fac1d88fe08709ea2559f4eba26d1afae329e2

SHA512
07a4cf95f7656190ad465127a836952a3a51f5f49db60de3541688576dad4f43b253dfdf7ba11b82d2edc285af62a9b2fc4e2eeebf911d76d8cd43abd4be2620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749e08b848faeda445a6de430d5bc1c7

SHA1
21e6f5c25eefb7a015169a0355ea00bbe4ea61a8

SHA256
6e199683e7b0ab347607cc980bba688d6e81890ddab262213cbe096b89a3561a

SHA512
5b21fab7a93dbcbd23545338ddf2952f20efcbdefaa2cb561a5e90b0052ee9d67465f9d167ab81e443f21063e4b124dad20b4ba2ebb4c2744f4265572dbde941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09f12647edfe1aad884636e9ad86686a

SHA1
6871019a1f1aefaa7e936bc00bcf8f984763ffdd

SHA256
f331a11b2dae373b7a5b48eb0f4aed8d1744357228cb8b191e0ffeee1749fe17

SHA512
209258a1934d0d02e51126d18496ab6feea495671fbaa15cf289492c3e3b71f76bd84090176ef8ccde8cfa3f59d939189be9d261f78b9cc4448bffbb48a506ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63b609a227a1724bde1b5a5a51201f78

SHA1
9efcd12ac4f8f73454c11d00070a314473a1c8e2

SHA256
96722ffd20b673bb0c20c963cc14d15bd2b3107dc67c65ba6671d0f1b582ecaf

SHA512
9a8be6b84989b0ee4caf31ddeb8d83602e02e18f7866fa55f88b2ad07bd267fe8a1d731602e16408437cbee00355f5a508bac5b21751ec292070064bdf4d444f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80cd901db338d0044de88a411dcd2c5e

SHA1
085ae0f835e6acabe305810a3b63aca2494241ef

SHA256
d953466f82798129c6746b726474f5422cf4d3c2106cc97d3657db51da20bda9

SHA512
fd465b798d37e211807fad1e7b14e2373d2fd6727286ce0c3d19e989980f8fbe294db0fd373aa42fc6233cd552bedc22953befb99afef3c26d23c86c597efbae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad6ada6417e6e5dfa198c88725acd47

SHA1
dae183e06a31622a3489069612b244fd8abbee51

SHA256
f85a7a756e8cc78706e2dbd287d7247471b288e78be2c89adb6c5030ff12d02c

SHA512
cdff8423eacf240072df19b8dc1fa7db36a179f5901f87da1082e8bf47d1c6ffe27feb3b034616463565cafbb4cc9bfa6cd2fb60fa75f5086cb49c30f13428b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1PSVF0QC\rmansys[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1PSVF0QC\rmansys[1].xml

Filesize
354B

MD5
50b697c9d1822df1b3010bc6dbe767a5

SHA1
de49067318c77bdcbb6319bca090273bc9c91197

SHA256
5f9c5903d45b09bbd0420f1232387b02c59bc86b6b07e67e30276c68006b0d17

SHA512
0f511c32432d50f10b9e1206ee7829146e9fdb80c49cb77039585286d3dbdb2015245e0b0c12c76207d998d35c2861a7c3803e24b58012c3e20e46d09590bcb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1PSVF0QC\rmansys[1].xml

Filesize
2KB

MD5
49319e0641b62b73ef38abee36b3d3eb

SHA1
64f331c8f3b3b426e385091f28e41d0611ae406e

SHA256
17477e1c06d28098a1a6873976c40987330df18fc359a081ee80f75d152ce808

SHA512
6652dd0a4ea47630d757421986bc644ea8773fdffdc7fda242164afee079661c735e0a4598277799499f5489399125321481aa6694b743acc8b8f5ce80599589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n4uupnw\imagestore.dat

Filesize
347KB

MD5
7cf5060ac2700fbe7219bd435510d063

SHA1
b6c4b8b930bc8db40e9ff4141d0674acf6bd2617

SHA256
f21e66e1889995f1c6dc624370a5de4d5150b6c1952cda3099dd5bcf283427fc

SHA512
c50b56b0f039da07cda79fe7c5255fc8382f8bc8b1597d1c8ba52143cdd75c2d9d82cc682053459488d8a1045a2ff26f6297db0c953ad0f4abecc279bafe8481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT8UAXPK\favicon[1].ico

Filesize
347KB

MD5
a71391a49a52013f1439de91ae173d6f

SHA1
d73ec1044cfdecfc7ed3c9524ba6b8991f109f75

SHA256
b425bb2e4ef3e22cfab086b36a110fb6569e8a0a0a0a8c987671acda423dbdff

SHA512
746dd25d165e3914837b1a85259aab596d62e9380b069867af9ac564e9be7c1a2a2f1766f09022d4a1bb52c7e4012d8708ab253d6d8c5aefc4735b62fa1922ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
232B

MD5
b3adc7c65dcbf585c21d00469c8a6c49

SHA1
58fb948da679d30a718dad186275d3a02045b9d5

SHA256
4d235c009676193204f8a0d045c49e08cd6c78e678469a2d899f95bdcf570347

SHA512
b42f41d205d971e4cc30ec9230e3951f5a1e9671739f37e3e8a21732b258cd7256021cae16ef07eb68288e35f07284dd19016f8c59f7886418cd5e37842d526d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host5.3ru.msi

Filesize
5.7MB

MD5
fe42b2a6ae84bbb706d72e17d38e0f2e

SHA1
942b308cb85cc06199427e0d40bc44f8705aabf8

SHA256
dbcc5a754b8685e18702a4e28adc6952a3df2ef52bbaafc8c0dc9ea6a4444e86

SHA512
fc42bc8216ae12b5231af94ae705ed9854faf4d91b9bdaaa087751383b689e665101d922be68609072a70cdde3f5079e55acf76e095b3cc75954030098604983

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3C5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD569.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Filesize
96KB

MD5
9e2c097647125ee25068784acb01d7d3

SHA1
1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5

SHA256
b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2

SHA512
e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\Installer\MSID639.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
memory/1440-766-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/1620-790-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/1620-785-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/1620-767-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/1632-340-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/2748-225-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2908-196-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2936-788-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2936-783-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2936-765-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2936-1236-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2936-1240-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/3044-193-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download