lumma | 7246aefd7681d59bc981afbece29efbe31ce1aabac8c3ee6d74a4e52afcda468

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RMS.7.1.7.0_configured_client.msi
Size

21.5MB
MD5

282e49971af85d26fcc453c1604dbca2
SHA1

e2fa2c353891cd1782d0237a65d86bd4ad9e811c
SHA256

7246aefd7681d59bc981afbece29efbe31ce1aabac8c3ee6d74a4e52afcda468
SHA512

486be3d725bf9828521fd883033eb1ee9c2b5cc3faee0bf8cab829deccff70c6510f92088876193ba7d3249390a4e0c166cf07850917a8fe2c1e5845a5e83705
SSDEEP

393216:p4HnfylxIDItISQ3f5W4YyGIi8224pPwpd0YDW0J9pd88lVpA:p4HaYkITCyGH822UoDW0e

Score

10^/10

lumma discovery persistence privilege_escalation stealer

Malware Config

Signatures

Detect Lumma Stealer payload V2 1 IoCs

resource	yara_rule
behavioral1/memory/2672-206-0x0000000000400000-0x0000000001897000-memory.dmp	family_lumma_V2

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2868	msiexec.exe
5	2868	msiexec.exe
7	2868	msiexec.exe
14	2668	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-11.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Logs\rms_log_2024-11.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File created	C:\Windows\Installer\f788a94.ipi	msiexec.exe
File created	C:\Windows\Installer\f788a96.msi	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f788a93.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f788a93.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90BD.tmp	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
1876	rfusclient.exe
2156	rutserv.exe
2644	rutserv.exe
2672	rutserv.exe
2664	rutserv.exe
2620	rutserv.exe
2508	rfusclient.exe
964	rfusclient.exe
1372	rfusclient.exe

Loads dropped DLL 11 IoCs

pid	Process
2116	MsiExec.exe
2156	rutserv.exe
2156	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2868	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\SysWOW64\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\PackageCode = "DBA1AAEAE60B87C4A91018B4785B4BA5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Version = "117506055"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\PackageName = "RMS.7.1.7.0_configured_client.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2BA10AC219E0CF4DA25D216B00E1DFC\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\ProductIcon = "C:\\Windows\\Installer\\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1876	rfusclient.exe
1876	rfusclient.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2508	rfusclient.exe
2508	rfusclient.exe
964	rfusclient.exe
964	rfusclient.exe
2508	rfusclient.exe
1372	rfusclient.exe
1372	rfusclient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeSecurityPrivilege	2668	msiexec.exe
Token: SeCreateTokenPrivilege	2868	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2868	msiexec.exe
Token: SeLockMemoryPrivilege	2868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2868	msiexec.exe
Token: SeMachineAccountPrivilege	2868	msiexec.exe
Token: SeTcbPrivilege	2868	msiexec.exe
Token: SeSecurityPrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeLoadDriverPrivilege	2868	msiexec.exe
Token: SeSystemProfilePrivilege	2868	msiexec.exe
Token: SeSystemtimePrivilege	2868	msiexec.exe
Token: SeProfSingleProcessPrivilege	2868	msiexec.exe
Token: SeIncBasePriorityPrivilege	2868	msiexec.exe
Token: SeCreatePagefilePrivilege	2868	msiexec.exe
Token: SeCreatePermanentPrivilege	2868	msiexec.exe
Token: SeBackupPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeShutdownPrivilege	2868	msiexec.exe
Token: SeDebugPrivilege	2868	msiexec.exe
Token: SeAuditPrivilege	2868	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2868	msiexec.exe
Token: SeChangeNotifyPrivilege	2868	msiexec.exe
Token: SeRemoteShutdownPrivilege	2868	msiexec.exe
Token: SeUndockPrivilege	2868	msiexec.exe
Token: SeSyncAgentPrivilege	2868	msiexec.exe
Token: SeEnableDelegationPrivilege	2868	msiexec.exe
Token: SeManageVolumePrivilege	2868	msiexec.exe
Token: SeImpersonatePrivilege	2868	msiexec.exe
Token: SeCreateGlobalPrivilege	2868	msiexec.exe
Token: SeCreateTokenPrivilege	2868	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2868	msiexec.exe
Token: SeLockMemoryPrivilege	2868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2868	msiexec.exe
Token: SeMachineAccountPrivilege	2868	msiexec.exe
Token: SeTcbPrivilege	2868	msiexec.exe
Token: SeSecurityPrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeLoadDriverPrivilege	2868	msiexec.exe
Token: SeSystemProfilePrivilege	2868	msiexec.exe
Token: SeSystemtimePrivilege	2868	msiexec.exe
Token: SeProfSingleProcessPrivilege	2868	msiexec.exe
Token: SeIncBasePriorityPrivilege	2868	msiexec.exe
Token: SeCreatePagefilePrivilege	2868	msiexec.exe
Token: SeCreatePermanentPrivilege	2868	msiexec.exe
Token: SeBackupPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeShutdownPrivilege	2868	msiexec.exe
Token: SeDebugPrivilege	2868	msiexec.exe
Token: SeAuditPrivilege	2868	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2868	msiexec.exe
Token: SeChangeNotifyPrivilege	2868	msiexec.exe
Token: SeRemoteShutdownPrivilege	2868	msiexec.exe
Token: SeUndockPrivilege	2868	msiexec.exe
Token: SeSyncAgentPrivilege	2868	msiexec.exe
Token: SeEnableDelegationPrivilege	2868	msiexec.exe
Token: SeManageVolumePrivilege	2868	msiexec.exe
Token: SeImpersonatePrivilege	2868	msiexec.exe
Token: SeCreateGlobalPrivilege	2868	msiexec.exe
Token: SeCreateTokenPrivilege	2868	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2868	msiexec.exe
964	rfusclient.exe
964	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
964	rfusclient.exe
964	rfusclient.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2156	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2644	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2672	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2664	rutserv.exe
2672	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe
2620	rutserv.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 2116	2668	msiexec.exe	31
PID 2668 wrote to memory of 1876	2668	msiexec.exe	36
PID 2668 wrote to memory of 1876	2668	msiexec.exe	36
PID 2668 wrote to memory of 1876	2668	msiexec.exe	36
PID 2668 wrote to memory of 1876	2668	msiexec.exe	36
PID 2668 wrote to memory of 2156	2668	msiexec.exe	37
PID 2668 wrote to memory of 2156	2668	msiexec.exe	37
PID 2668 wrote to memory of 2156	2668	msiexec.exe	37
PID 2668 wrote to memory of 2156	2668	msiexec.exe	37
PID 2668 wrote to memory of 2644	2668	msiexec.exe	38
PID 2668 wrote to memory of 2644	2668	msiexec.exe	38
PID 2668 wrote to memory of 2644	2668	msiexec.exe	38
PID 2668 wrote to memory of 2644	2668	msiexec.exe	38
PID 2668 wrote to memory of 2672	2668	msiexec.exe	39
PID 2668 wrote to memory of 2672	2668	msiexec.exe	39
PID 2668 wrote to memory of 2672	2668	msiexec.exe	39
PID 2668 wrote to memory of 2672	2668	msiexec.exe	39
PID 2668 wrote to memory of 2664	2668	msiexec.exe	40
PID 2668 wrote to memory of 2664	2668	msiexec.exe	40
PID 2668 wrote to memory of 2664	2668	msiexec.exe	40
PID 2668 wrote to memory of 2664	2668	msiexec.exe	40
PID 2620 wrote to memory of 2508	2620	rutserv.exe	42
PID 2620 wrote to memory of 2508	2620	rutserv.exe	42
PID 2620 wrote to memory of 2508	2620	rutserv.exe	42
PID 2620 wrote to memory of 2508	2620	rutserv.exe	42
PID 2620 wrote to memory of 964	2620	rutserv.exe	43
PID 2620 wrote to memory of 964	2620	rutserv.exe	43
PID 2620 wrote to memory of 964	2620	rutserv.exe	43
PID 2620 wrote to memory of 964	2620	rutserv.exe	43
PID 2508 wrote to memory of 1372	2508	rfusclient.exe	44
PID 2508 wrote to memory of 1372	2508	rfusclient.exe	44
PID 2508 wrote to memory of 1372	2508	rfusclient.exe	44
PID 2508 wrote to memory of 1372	2508	rfusclient.exe	44

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RMS.7.1.7.0_configured_client.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9D05C74DC6E76F1053C154917FC2EB6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RMS.7.1.7.0_configured_client.msi"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2156
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /CONFIG /SETSECURITY
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2672
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2096

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003F0" "0000000000000068"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2200

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1372
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll

Filesize
51KB

MD5
4e84df6558c385bc781cddea34c9fba3

SHA1
6d63d87c19c11bdbfa484a5835ffffd7647296c8

SHA256
0526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d

SHA512
c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
10.2MB

MD5
06208aa91f0f77d6c9b989f65803382a

SHA1
75e37439e6d1537fadf38c758df3a9fb232313cf

SHA256
d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5

SHA512
a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
19.8MB

MD5
41dc282cbf89b0737ae6dd2de5a71015

SHA1
4aac4bafaf43be690089549584770f9e88630b45

SHA256
b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

SHA512
ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
379KB

MD5
e247666cdea63da5a95aebc135908207

SHA1
4642f6c3973c41b7d1c9a73111a26c2d7ac9c392

SHA256
b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33

SHA512
06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
1.6MB

MD5
d5c2a6ac30e76b7c9b55adf1fe5c1e4a

SHA1
3d841eb48d1a32b511611d4b9e6eed71e2c373ee

SHA256
11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428

SHA512
3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Filesize
259KB

MD5
49c51ace274d7db13caa533880869a4a

SHA1
b539ed2f1a15e2d4e5c933611d736e0c317b8313

SHA256
1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b

SHA512
13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Filesize
364KB

MD5
eda07083af5b6608cb5b7c305d787842

SHA1
d1703c23522d285a3ccdaf7ba2eb837d40608867

SHA256
c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d

SHA512
be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Filesize
859KB

MD5
642dc7e57f0c962b9db4c8fb346bc5a7

SHA1
acee24383b846f7d12521228d69135e5704546f6

SHA256
63b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede

SHA512
fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae

Download Submit
C:\ProgramData\Remote Manipulator System\msi\70170_{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\RMS.7.1.7.0_configured_client.msi

Filesize
21.5MB

MD5
282e49971af85d26fcc453c1604dbca2

SHA1
e2fa2c353891cd1782d0237a65d86bd4ad9e811c

SHA256
7246aefd7681d59bc981afbece29efbe31ce1aabac8c3ee6d74a4e52afcda468

SHA512
486be3d725bf9828521fd883033eb1ee9c2b5cc3faee0bf8cab829deccff70c6510f92088876193ba7d3249390a4e0c166cf07850917a8fe2c1e5845a5e83705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
6ffcc08afff66cb043499364b8d087b3

SHA1
697582ea5a9bbd0fa7379c56cf6819942444ad7e

SHA256
a9345354e0efb6635b68e28cc14d15fa9b29d9d9a60734780ed92ae53e428c18

SHA512
155c87a07e7732977bb540b8517c1fbb6ccde96ea0c9cda4a1531353e038a0d6d05e4d2dd6187a468a7811bee640eb47a64eb38d45053a7d09cd2c60ac0d3398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_DDC6638534E8608691DE0CEAFF22DE0F

Filesize
471B

MD5
e5a7c1c1bddfe96adba491bdb4dc2dc4

SHA1
dae98cf0a90833f51f9bd527cf396327018501f2

SHA256
b154d4cd22bc400c4159504295dc38a1cb8d3511ab3203ccc9e82c06be70da63

SHA512
db83b0f7159d47a0a884369de2c45dd729882061b3b7cc07c97b5b848f9b648684fb3ad3281b75dab334632b40b520164ea41791b64781d61907f674981ec065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
59c492f14c65d98685c2aa054a5f1104

SHA1
3df8b5e0f92b3ee160da9af084d7decb726e3454

SHA256
588b5f4e465996431d59d09c0b1ce3ea977db5e74b8e70380f26b2b034fbba49

SHA512
b9d445bfb92bf6376695fdfad9d7cc0845df3fc8b1d099260e3a49f24904e99688e4171e9720a8b9ea7c128246c968756d20ae6db6aa91c4992743e204ef57c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_DDC6638534E8608691DE0CEAFF22DE0F

Filesize
408B

MD5
bc7d9c3dd17fb0e4e6debaf842136b37

SHA1
ccfe49a0f43975574845bc047a4e986663831bfd

SHA256
d3cdfa3c69146b09e2ab16279f00a7a677dea1302ee33e1d97402853bad72348

SHA512
8de66c3ff9fa3dd62a2aa5a3573e990a8f5f1289fc65ddad5716f30f385eb5885f2d98e71031f2682ce163aa34f9a828a4114f20f98f825980a26d5b73dcf98c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7391f0681b3b91086f15e5fec45d725

SHA1
69a141785bc81b6e88af3932e141b33a99d9c0a0

SHA256
aba0bc04656546f41c35ad7139be25fcf39d09e7640036757b5c04452ccf847d

SHA512
325c6d9412708756f3d1aed8be43a1d91dd2ce80102db560ff27ae3dd7ea745c1181138fd34e5cb910a3a525c5ede3e155cfec15715b0490c0ff5f0a18136cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI396E.tmp

Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

Filesize
1.3MB

MD5
5222eaf78313758b0520be16e3f8392e

SHA1
9c7cc8fb340618fef38422cf0c75c4c9bfb216e2

SHA256
4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5

SHA512
459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812

Download Submit
\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll

Filesize
337KB

MD5
90a4b7fc6807693e68dd32b68614d989

SHA1
785484ef531ca90f323d5b017fefcff05e68093a

SHA256
4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6

SHA512
97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c

Download Submit
memory/964-209-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/964-204-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/964-197-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/1372-198-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/1876-133-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2156-149-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2508-196-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2620-199-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2620-207-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2620-178-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2620-202-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2644-153-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2664-177-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2664-174-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2672-201-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2672-195-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2672-206-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download
memory/2672-172-0x0000000000400000-0x0000000001897000-memory.dmp

Filesize
20.6MB

Download