rms | d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
Size

5.0MB
MD5

723a7e3f2a293f526c2574cfad06b72b
SHA1

54c9a81aa53962beb066402e63464f7b18d34273
SHA256

d3a32569a3a7a940b94ea29e963643adf9a15308c5b2074a11d29fbb5ff27fec
SHA512

a4183af1435af07da77d96ca992190d06d5c5bda37528a5c5a4aeb811aedaa6c26ebaa7d26347d066d92ce60f11e2c893b5ed0526e71daebd8d65aca2afdc70b
SSDEEP

98304:YogY3IgMAk7BepFZXiWDoFA9hvfbDU+epbQ9DgG6O2kF2KaQ+02usPfdN:YS3IRRwp/Xi+KAjffU+epbytUkF9aQ+V

Score

10^/10

rms discovery rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe

Executes dropped EXE 7 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
4772	rutserv.exe
5336	rutserv.exe
5464	rutserv.exe
5600	rutserv.exe
5732	rfusclient.exe
5724	rfusclient.exe
3280	rfusclient.exe

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid	Process
2528	MsiExec.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow	pid	Process
63	1064	msiexec.exe
66	1064	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 17 IoCs

Processes:

rutserv.exemsiexec.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-07.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6DB.tmp	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File created	C:\Windows\Installer\e57c2c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c2c3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57c2c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File created	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC592.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B04BFE4C-7F11-49D8-ADFE-867939D886FA}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exemsiexec.exemsiexec.exerfusclient.exeMsiExec.exerutserv.exerutserv.exe723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exePING.EXEmsiexec.exerfusclient.exerfusclient.exechcp.comrutserv.exerutserv.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
4984	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF\Remote_Office_Manager	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\PackageCode = "3041FA689ACC3184E99A4B5081B5660B"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\ProductIcon = "C:\\Windows\\Installer\\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\C4EFB40B11F78D94DAEF6897938D68AF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\Version = "100600760"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\PackageName = "rms.host5.3ru.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4EFB40B11F78D94DAEF6897938D68AF\SourceList\Media	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
4984	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exemsedge.exemsiexec.exeidentity_helper.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exemsedge.exe

pid	Process
1988	msedge.exe
1988	msedge.exe
3028	msedge.exe
3028	msedge.exe
1064	msiexec.exe
1064	msiexec.exe
2692	identity_helper.exe
2692	identity_helper.exe
4772	rutserv.exe
4772	rutserv.exe
5336	rutserv.exe
5336	rutserv.exe
5464	rutserv.exe
5464	rutserv.exe
5600	rutserv.exe
5600	rutserv.exe
5600	rutserv.exe
5600	rutserv.exe
5600	rutserv.exe
5600	rutserv.exe
5724	rfusclient.exe
5724	rfusclient.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid	Process
3280	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	1320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	1064	msiexec.exe
Token: SeCreateTokenPrivilege	1320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1320	msiexec.exe
Token: SeLockMemoryPrivilege	1320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1320	msiexec.exe
Token: SeMachineAccountPrivilege	1320	msiexec.exe
Token: SeTcbPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	1320	msiexec.exe
Token: SeTakeOwnershipPrivilege	1320	msiexec.exe
Token: SeLoadDriverPrivilege	1320	msiexec.exe
Token: SeSystemProfilePrivilege	1320	msiexec.exe
Token: SeSystemtimePrivilege	1320	msiexec.exe
Token: SeProfSingleProcessPrivilege	1320	msiexec.exe
Token: SeIncBasePriorityPrivilege	1320	msiexec.exe
Token: SeCreatePagefilePrivilege	1320	msiexec.exe
Token: SeCreatePermanentPrivilege	1320	msiexec.exe
Token: SeBackupPrivilege	1320	msiexec.exe
Token: SeRestorePrivilege	1320	msiexec.exe
Token: SeShutdownPrivilege	1320	msiexec.exe
Token: SeDebugPrivilege	1320	msiexec.exe
Token: SeAuditPrivilege	1320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1320	msiexec.exe
Token: SeChangeNotifyPrivilege	1320	msiexec.exe
Token: SeRemoteShutdownPrivilege	1320	msiexec.exe
Token: SeUndockPrivilege	1320	msiexec.exe
Token: SeSyncAgentPrivilege	1320	msiexec.exe
Token: SeEnableDelegationPrivilege	1320	msiexec.exe
Token: SeManageVolumePrivilege	1320	msiexec.exe
Token: SeImpersonatePrivilege	1320	msiexec.exe
Token: SeCreateGlobalPrivilege	1320	msiexec.exe
Token: SeShutdownPrivilege	2940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2940	msiexec.exe
Token: SeCreateTokenPrivilege	2940	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2940	msiexec.exe
Token: SeLockMemoryPrivilege	2940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2940	msiexec.exe
Token: SeMachineAccountPrivilege	2940	msiexec.exe
Token: SeTcbPrivilege	2940	msiexec.exe
Token: SeSecurityPrivilege	2940	msiexec.exe
Token: SeTakeOwnershipPrivilege	2940	msiexec.exe
Token: SeLoadDriverPrivilege	2940	msiexec.exe
Token: SeSystemProfilePrivilege	2940	msiexec.exe
Token: SeSystemtimePrivilege	2940	msiexec.exe
Token: SeProfSingleProcessPrivilege	2940	msiexec.exe
Token: SeIncBasePriorityPrivilege	2940	msiexec.exe
Token: SeCreatePagefilePrivilege	2940	msiexec.exe
Token: SeCreatePermanentPrivilege	2940	msiexec.exe
Token: SeBackupPrivilege	2940	msiexec.exe
Token: SeRestorePrivilege	2940	msiexec.exe
Token: SeShutdownPrivilege	2940	msiexec.exe
Token: SeDebugPrivilege	2940	msiexec.exe
Token: SeAuditPrivilege	2940	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2940	msiexec.exe
Token: SeChangeNotifyPrivilege	2940	msiexec.exe
Token: SeRemoteShutdownPrivilege	2940	msiexec.exe
Token: SeUndockPrivilege	2940	msiexec.exe
Token: SeSyncAgentPrivilege	2940	msiexec.exe
Token: SeEnableDelegationPrivilege	2940	msiexec.exe
Token: SeManageVolumePrivilege	2940	msiexec.exe
Token: SeImpersonatePrivilege	2940	msiexec.exe
Token: SeCreateGlobalPrivilege	2940	msiexec.exe
Token: SeShutdownPrivilege	3608	msiexec.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msiexec.exemsedge.exemsiexec.exerfusclient.exe

pid	Process
1320	msiexec.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
1320	msiexec.exe
2940	msiexec.exe
2940	msiexec.exe
5732	rfusclient.exe
5732	rfusclient.exe
5732	rfusclient.exe
5732	rfusclient.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

msedge.exerfusclient.exe

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
5732	rfusclient.exe
5732	rfusclient.exe
5732	rfusclient.exe
5732	rfusclient.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exemsedge.execmd.exe

description	pid	Process	procid_target
PID 1436 wrote to memory of 3028	1436	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	87
PID 1436 wrote to memory of 3028	1436	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	87
PID 3028 wrote to memory of 3824	3028	msedge.exe	88
PID 3028 wrote to memory of 3824	3028	msedge.exe	88
PID 1436 wrote to memory of 3280	1436	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	89
PID 1436 wrote to memory of 3280	1436	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	89
PID 1436 wrote to memory of 3280	1436	723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe	89
PID 3280 wrote to memory of 320	3280	cmd.exe	91
PID 3280 wrote to memory of 320	3280	cmd.exe	91
PID 3280 wrote to memory of 320	3280	cmd.exe	91
PID 3280 wrote to memory of 1320	3280	cmd.exe	92
PID 3280 wrote to memory of 1320	3280	cmd.exe	92
PID 3280 wrote to memory of 1320	3280	cmd.exe	92
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1148	3028	msedge.exe	93
PID 3028 wrote to memory of 1988	3028	msedge.exe	94
PID 3028 wrote to memory of 1988	3028	msedge.exe	94
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95
PID 3028 wrote to memory of 1620	3028	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\723a7e3f2a293f526c2574cfad06b72b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rmansys.ru/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8eda246f8,0x7ff8eda24708,0x7ff8eda24718
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,13539873750820528702,10522719884388195517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:320
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1320
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {B04BFE4C-7F11-49D8-ADFE-867939D886FA} /passive REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2940
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4984
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "rms.host5.3ru.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81A7596BCC1895F35162BFC3E9FE135B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5336
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5600
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5724
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:3280
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c2c6.rbs

Filesize
15KB

MD5
a8a368ffe05d7cae78839aa54318d125

SHA1
ab241587b29bed7dafb0c5d4d15062c06a375235

SHA256
3b24b97907bee4ce4f4c6582ea7f9f0bc1e81ab7cb3aa804675a1c811e0fa02e

SHA512
c494edd6e70ce729d2280a4cc530537aae50fcf2ba2b860b812a3f564badf0a2c31245d58d24bcaedad3139da1059e113a2d89757321759cbf32076f1b46c3d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
42KB

MD5
1239f13726dd9ed2741688b28bec9c01

SHA1
f960677a139da7d7c758330510b43028377a9bf7

SHA256
5572df7bedc2b0d0812643af2c8ee03eaba744df3f01940207122426d2a21339

SHA512
89835f0d6a7453c25432e0d7f0072b9c89558bd567ac81cfa726cf638598e07b282e8df17f5068bcfe54843a696463a0276a9bb68cdb0daabce563f9a2a45ad5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
144KB

MD5
30e269f850baf6ca25187815912e21c5

SHA1
eb160de97d12b4e96f350dd0d0126d41d658afb3

SHA256
379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90

SHA512
9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
357KB

MD5
bb1f3e716d12734d1d2d9219a3979a62

SHA1
0ef66eed2f2ae45ec2d478902833b830334109cb

SHA256
d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077

SHA512
bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
47KB

MD5
83d34dbe5ec48888b06d471ee12ab9fe

SHA1
4c6d12ac5a4d3f668b3e58d02d69b0af6559fb47

SHA256
d2fe39c745748bf73f16367893d6ce4329dc68a68e6c79acc0ed0a240300a936

SHA512
ddce22974a5bfe4ee32d100b05d4b01661e0e51e6e5b27595220a3edac2aa31d90b5389cb33cd492e38126732eac247664b8d93f883399d73f84e6858affec4d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
3.9MB

MD5
8887cd8cf57b949ecc28a28eff53be4d

SHA1
03e2f01ae0342257f743f354e331a527356a3048

SHA256
6784ad757bc2ffd189a11dfb627ea43596b4ad66a62217a5e22f509bdb4bd09d

SHA512
3e784a7bd945b077ea955ec3419361c9a757865750b520ab3e99cab2660120c4b27ed1b0b29e4566788eba46fd5a2d72be4c6972611f8ae3528d840eb60fb415

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
5.1MB

MD5
38daaf395100a422806f0c7398fe5142

SHA1
493b0f2f9e2af05698ef9862bcef49f40cca8be4

SHA256
7cdc4543bf05da7c2f25048169c338035dec83155ead1d7d08ebb13a1e34f032

SHA512
892dc4647d7a3f2d67d9b32905a3dfbf729145320cf8384ecd32e3ead4f42563c0b0a94a6086fd23e0850999ec7276f4037a7285804ed8ec224467e3cb591c0d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
0cc2c378583c9c23b925aa6416c1db41

SHA1
d4dfeb7a044962ce18887996678ec19f0b0a3abe

SHA256
47b4de8dd95686f083f442fb57e91bbde6f9be8e21704056178ec81de88680a0

SHA512
e231fe9bd8a9b85ebf2d55487fa1b91b252dc9ff7b96859a99f2d55ec244866b6405a2a455d014490955982a554e690f373b5aeab20fa5f474eca2a468385624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e54245c5c05250865ba8cc5d35bdfcfe

SHA1
ccf42a5db21cdcdcc2369fb6fb9c4d6f272bb19e

SHA256
4b5a84066fed2f0f8e6e4d5d9a939ecd2ed160b6670b6c7e80f9a3e3a0c7dacb

SHA512
1546511d77f1bca7a9a55e9f137fde573e260ac75f19aa590072d414fef83fabc175df0e1dba5399a9eae5ca9d36acc5c322d2d859023774cda283561e208ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
10c49af66ad661ecbcedf6963e7a299d

SHA1
3179baad5ce0ab33b149fbd6c2f1824b9c6d9924

SHA256
703c4ef0d4c2a6fdea6fb33663c8975d823b2dcc5ec62de346dbbd6d779e8f5f

SHA512
757dcedcfb2d01bc66f91fe0481eb217d792af43047809839167c3f56e050109bafae40ba84bb84c5dccd48cf0ba85cf28aa9654c827e1367c50e6560c901ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40e524ecd2969d8596a3d91f235f343a

SHA1
6c7fb4e3062c06d1e5aa96e895106e41b58b7c54

SHA256
3041b7d36b271c588d95ec7503a31b6f1d6cd5611c8b12dac376143d628ea8e8

SHA512
517284df7e652e71b741b6aa34c69d7e65790a0b7f2ccd04b220bb364759861c0b5d78190ee012543bfcf505c266191a13b18f39e50b08c1e4d0df060725d314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
fa84d2adac4119c4a82fbe70eaf2073d

SHA1
34cb09098de5d0db64b949e036ecabdd40969e8b

SHA256
291c53cdcb9a31456f95f61b33c7aad73f46474a500e19eecf55cfd25946de09

SHA512
a1a7295fd98065275c4724a2b14db680d826742772af8325bf24fe6a71ce42ee5e392cc6ddce6150fcb0c7ff6468f0c84c7d0dea5bada88025ece595e359624f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a59.TMP

Filesize
706B

MD5
cef3b576b0dcfb8276ef561a27e0dd17

SHA1
e291d51c868cd6df92a64eb334be468f77f35445

SHA256
f3c5f4779209f4b85e90dc2a409cd0009ffc7919db9451912ec10ff569ad7ea9

SHA512
e133aaa4049789b52215973de08562257407dc26376f7247b8a81b14195bcea0da65533dd6dfabc586cb846c69d06b3e34d3857c30601c71114746db09f67830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23e10177ea8231d5008b09419726f3c1

SHA1
b68c2c99c3780b8dbcb94ad229105f1d2f0a17b3

SHA256
6c9f83991f51b5c720549666d59faea14a21d06c9cc3f98fcf0887b47f28ccc9

SHA512
ea38930b42f594bbff1598b388a5f24230179093169e7a436c4738c4bc09e660c59e05481bc0038576cc4cf6673638dde5afe8426f141f906512d5dd10d2cd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
232B

MD5
b3adc7c65dcbf585c21d00469c8a6c49

SHA1
58fb948da679d30a718dad186275d3a02045b9d5

SHA256
4d235c009676193204f8a0d045c49e08cd6c78e678469a2d899f95bdcf570347

SHA512
b42f41d205d971e4cc30ec9230e3951f5a1e9671739f37e3e8a21732b258cd7256021cae16ef07eb68288e35f07284dd19016f8c59f7886418cd5e37842d526d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host5.3ru.msi

Filesize
5.7MB

MD5
fe42b2a6ae84bbb706d72e17d38e0f2e

SHA1
942b308cb85cc06199427e0d40bc44f8705aabf8

SHA256
dbcc5a754b8685e18702a4e28adc6952a3df2ef52bbaafc8c0dc9ea6a4444e86

SHA512
fc42bc8216ae12b5231af94ae705ed9854faf4d91b9bdaaa087751383b689e665101d922be68609072a70cdde3f5079e55acf76e095b3cc75954030098604983

Download Submit
C:\Windows\Installer\MSIC592.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\Installer\{B04BFE4C-7F11-49D8-ADFE-867939D886FA}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Filesize
96KB

MD5
9e2c097647125ee25068784acb01d7d3

SHA1
1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5

SHA256
b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2

SHA512
e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1

Download Submit
\??\pipe\LOCAL\crashpad_3028_HEWCWEGDBWGDZKEW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3280-200-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/4772-144-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5336-146-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5464-173-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5600-228-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5600-202-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5600-289-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5600-292-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/5724-203-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/5732-204-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/5732-230-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download
memory/5732-235-0x0000000000400000-0x0000000000872000-memory.dmp

Filesize
4.4MB

Download