Edit tour

Windows Analysis Report
RemotePCViewer.exe

Overview

General Information

Sample name:	RemotePCViewer.exe
Analysis ID:	1534294
MD5:	79c8f44b7ece48d2dfbb244ff39762e4
SHA1:	27df4352ddeee0186f43c1cffffef17ac9b032b0
SHA256:	be52e818839cf4d168ba589f2e868c4373c548e6a8c3a87a68d06a7c579640af
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Installs new ROOT certificates

Modifies the windows firewall

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sets file extension default program settings to executables

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Connects to many different domains

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Registers a DLL

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

RemotePCViewer.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\RemotePCViewer.exe" MD5: 79C8F44B7ECE48D2DFBB244FF39762E4)

RemotePCViewer.tmp (PID: 6884 cmdline: "C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp" /SL5="$50374,74130656,209408,C:\Users\user\Desktop\RemotePCViewer.exe" MD5: 88034E73F506B50AB286BCB5A6357908)

RPCFireWallRule.exe (PID: 6184 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe" ftfirewall MD5: C7999200FC6DA121147D6AB084C9A6EC)

cmd.exe (PID: 6280 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6496 cmdline: netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1276 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 408 cmdline: netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 5736 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1372 cmdline: netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2888 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6744 cmdline: netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 7020 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1176 cmdline: netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2092 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2408 cmdline: netsh advfirewall firewall show rule name="RPCCoreViewer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 4044 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4152 cmdline: netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3344 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2544 cmdline: netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3512 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5320 cmdline: netsh advfirewall firewall show rule name="RPCViewerUIU" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 4252 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5924 cmdline: netsh advfirewall firewall show rule name="RPCViewerUIU" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2276 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1856 cmdline: netsh advfirewall firewall show rule name="RPCViewer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1084 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3860 cmdline: netsh advfirewall firewall show rule name="RPCViewer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6188 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6292 cmdline: netsh advfirewall firewall show rule name="RemotePCUI" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3544 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3012 cmdline: netsh advfirewall firewall show rule name="RemotePCUI" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 852 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 636 cmdline: netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1920 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3648 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 5136 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5652 cmdline: netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1980 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCodecEngine" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6036 cmdline: netsh advfirewall firewall show rule name="RPCCodecEngine" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 1768 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCodecEngine" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2656 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4596 cmdline: netsh advfirewall firewall show rule name="RPCSoundServer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 4892 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7148 cmdline: netsh advfirewall firewall show rule name="RPCSoundServer" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2188 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6208 cmdline: netsh advfirewall firewall show rule name="RPCDesktop" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2420 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5108 cmdline: netsh advfirewall firewall show rule name="RPCDesktop" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 5080 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6308 cmdline: netsh advfirewall firewall show rule name="RPCService" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3720 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5076 cmdline: netsh advfirewall firewall show rule name="RPCService" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6944 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6288 cmdline: netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6928 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2884 cmdline: netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 7152 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=in verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5152 cmdline: netsh advfirewall firewall show rule name="RemotePC" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2652 cmdline: "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=out verbose MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4428 cmdline: netsh advfirewall firewall show rule name="RemotePC" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 5848 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5612 cmdline: netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 4004 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 68 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 876 cmdline: netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2672 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6084 cmdline: netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2336 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1388 cmdline: netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6848 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4840 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5860 cmdline: netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6096 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3964 cmdline: netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 6884 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 1992 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6684 cmdline: netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3896 cmdline: "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3228 cmdline: netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

WMIADAP.exe (PID: 852 cmdline: wmiadap.exe /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)

RPDUILaunch.exe (PID: 6200 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 1 MD5: 66CAFE378D6976FFB97DB3C67F2BF7B4)

RemotePCLauncher.exe (PID: 6228 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 1 MD5: E7BC2B0D0FEC0DB7567509E7C3803199)

RemotePCLauncher.exe (PID: 1272 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4 MD5: E7BC2B0D0FEC0DB7567509E7C3803199)

RPDUILaunch.exe (PID: 1768 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 3 MD5: 66CAFE378D6976FFB97DB3C67F2BF7B4)

conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2848 cmdline: netsh advfirewall firewall show rule name="RPCCodecEngine" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

sc.exe (PID: 1164 cmdline: "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\"" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1920 cmdline: "C:\Windows\system32\sc.exe" failure ViewerService reset= INFINITE actions= restart/2000/restart/2000/restart/2000 MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2332 cmdline: netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

sc.exe (PID: 3648 cmdline: "C:\Windows\system32\sc.exe" start ViewerService MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6232 cmdline: netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=in verbose MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

RemotePCPerformance.exe (PID: 4228 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe" /S /ViewerOnly /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance MD5: 0622D1B4F1429D8537C92E99C83B71BB)

regsvr32.exe (PID: 1364 cmdline: C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

RegAsm.exe (PID: 6388 cmdline: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /u /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll" MD5: E7AFB32EE31430EBC28AAEB5D2D82FAD)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 2064 cmdline: C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 6272 cmdline: /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

RegAsm.exe (PID: 6256 cmdline: "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /tlb /register /codebase /nologo /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll" MD5: E7AFB32EE31430EBC28AAEB5D2D82FAD)

conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6028 cmdline: netsh advfirewall firewall add rule name="RPCCodecEngineViewer" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1472 cmdline: netsh advfirewall firewall add rule name= "TransferClient ports" dir=out program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe" action=allow protocol=TCP localport=4434-4444 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1000 cmdline: netsh advfirewall firewall add rule name="TransferClient" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6416 cmdline: C:\Windows\system32\schtasks /create /SC DAILY /st 12:00 /TN "RPCPerformanceHealthCheckViewer" /TR "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerformanceDownloader.exe" /rl HIGHEST /ru system MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PluginInstaller.exe (PID: 3952 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "1" MD5: 2F6E6112DE890971EB2D54B1375F82DE)

RemotePCPerformancePlugins.exe (PID: 7116 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe" /S /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance MD5: 1E913FE1D8C561FEEFF71D37B0B1BC7A)

PluginInstaller.exe (PID: 6744 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "2" MD5: 2F6E6112DE890971EB2D54B1375F82DE)

RemotePCPerformancePrinter.exe (PID: 5076 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe" /S /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance MD5: 718FC8B1E4FDC147D6A098A4CE5E4A6D)

RPCDownloader.exe (PID: 3484 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" webview MD5: C176BB00C634ED08BAD878127FE9DAA0)

BSUtility.exe (PID: 3508 cmdline: "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" zip MD5: 94AC1EFB8FAEF766E42663400D4F0F99)

BSUtility.exe (PID: 2016 cmdline: "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" vcredist2017 MD5: 94AC1EFB8FAEF766E42663400D4F0F99)

vcredist2017.exe (PID: 5388 cmdline: "C:\ProgramData\RemotePC Viewer\vcredist2017.exe" /SILENT /VERYSILENT /SUPPRESSMSGBOXES /NORESTART MD5: D87640D43D161241D461949812E91D60)

vcredist2017.exe (PID: 772 cmdline: "C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe" -burn.clean.room="C:\ProgramData\RemotePC Viewer\vcredist2017.exe" -burn.filehandle.attached=680 -burn.filehandle.self=536 /SILENT /VERYSILENT /SUPPRESSMSGBOXES /NORESTART MD5: 77E7ADAC36B6C0AA3497AB855328742B)

RPCDownloader.exe (PID: 5428 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" vieweruilaunch MD5: C176BB00C634ED08BAD878127FE9DAA0)

RPCViewerUIU.exe (PID: 1120 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" MD5: 84F23CADBB76D73B31FB4840F7B9E89E)

RemotePCLauncher.exe (PID: 4176 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4 MD5: E7BC2B0D0FEC0DB7567509E7C3803199)

RPCProxyLatency.exe (PID: 5732 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCProxyLatency.exe" 0 MD5: B8E946153D9C3D479C06ADDCF07EBDF4)

ViewerHostKeyPopup.exe (PID: 7036 cmdline: ViewerHostKeyPopup.exe 12 MD5: A90294E2AD819529ADC189A2ACF59EDC)

RPCDownloader.exe (PID: 5336 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" pdfdll MD5: C176BB00C634ED08BAD878127FE9DAA0)

RPCDownloader.exe (PID: 4416 cmdline: "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" trayrefresh MD5: C176BB00C634ED08BAD878127FE9DAA0)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2280 cmdline: netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5884 cmdline: netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product." MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

ViewerService.exe (PID: 3492 cmdline: "C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe" MD5: 6504E0CFB7268A61E8EFC6ACEFF5ED80)

RPCViewerUIU.exe (PID: 3344 cmdline: /K LFVSCPU MD5: 84F23CADBB76D73B31FB4840F7B9E89E)

WmiApSrv.exe (PID: 4888 cmdline: C:\Windows\system32\wbem\WmiApSrv.exe MD5: 9A48D32D7DBA794A40BF030DA500603B)

svchost.exe (PID: 4200 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\RemotePC Viewer\Spire.Pdf.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\RemotePC Viewer\Spire.Pdf.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 9 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: RPCAuthProvider, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe, ProcessId: 4228, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{19695582-B6B6-4A51-9DB2-A38DA71746DD}\(Default)

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe, ProcessId: 1120, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePCViewer.lnk

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\"", CommandLine: "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\"", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp" /SL5="$50374,74130656,209408,C:\Users\user\Desktop\RemotePCViewer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp, ParentProcessId: 6884, ParentProcessName: RemotePCViewer.tmp, ProcessCommandLine: "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\"", ProcessId: 1164, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, ProcessId: 4200, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: RemotePCViewer.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Creates install or setup log file

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe

File created: C:\ProgramData\RemotePC Performance Viewer\Logs\PerformanceSetup.log

PE / OLE file has a valid certificate

Source: RemotePCViewer.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File opened: C:\Program Files (x86)\RemotePC Viewer\msvcr100.dll

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 64.90.202.245:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.40.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.40.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.37.123:443 -> 192.168.2.16:49714 version: TLS 1.2

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\RemotePC Viewer\Spire.Pdf.dll, type: DROPPED

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 49

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: download.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: static.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: userfornia.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: donewyork1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: iddallas1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: memphis.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: raleigh.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: atlanta.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: sanjose.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: taipei.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: bucharest.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: secaucus.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: london.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: tampa.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: bangkok.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: iddenver.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: newyork.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: donewyork2.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: dallas.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: hanoi.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: bucharest1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: neworleans.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: iddetroit.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: dosfo1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: idchicago1.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: dosfo2.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: santiago.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: orlando.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: bangalore4.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: albany.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: azchicago.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: osaka.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: charlotte.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: frankfurt.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: bluffdale.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: la4.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: idlondon.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: marseille.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: auckland.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: idmadrid.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: medellin.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: lansing.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: sydney.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: donewyork3.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: lima.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: dubai.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: riverside.remotepc.com
Source: global traffic	DNS traffic detected: DNS query: montreal.remotepc.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 64.90.202.245:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.40.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.40.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.37.123:443 -> 192.168.2.16:49714 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File created: C:\Program Files (x86)\RemotePC Viewer\VirtualAudioDriver\is-4IM1T.tmp

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Service1
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

DDoS

Too many similar processes found

Source: netsh.exe	Process created: 50
Source: conhost.exe	Process created: 46
Source: cmd.exe	Process created: 75

System Summary

Uses 32bit PE files

Source: RemotePCViewer.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal84.troj.evad.winEXE@240/436@49/362

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File created: C:\Program Files (x86)\RemotePC Viewer

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:120:WilError_03
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Mutant created: \Sessions\1\BaseNamedObjects\remotepc2022Viewer_setup_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:364:120:WilError_03
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\RemotePCMutex1947RPCVieweruser
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_03

Source: C:\Users\user\Desktop\RemotePCViewer.exe

File created: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File read: C:\ProgramData\RemotePC Viewer\RPCSettings.ini

Source: C:\Users\user\Desktop\RemotePCViewer.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\Desktop\RemotePCViewer.exe

File read: C:\Users\user\Desktop\RemotePCViewer.exe

Source: unknown	Process created: C:\Users\user\Desktop\RemotePCViewer.exe "C:\Users\user\Desktop\RemotePCViewer.exe"
Source: C:\Users\user\Desktop\RemotePCViewer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp "C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp" /SL5="$50374,74130656,209408,C:\Users\user\Desktop\RemotePCViewer.exe"
Source: C:\Users\user\Desktop\RemotePCViewer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp "C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp" /SL5="$50374,74130656,209408,C:\Users\user\Desktop\RemotePCViewer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe "C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe" ftfirewall
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 1
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 3
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\""
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" failure ViewerService reset= INFINITE actions= restart/2000/restart/2000/restart/2000
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCoreViewer" dir=out verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" start ViewerService
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe
Source: unknown	Process created: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe" /S /ViewerOnly /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=in verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" webview
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCViewerUIU" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCViewerUIU" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RemotePCUI" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RemotePCUI" dir=out verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" zip
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" vcredist2017
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" vieweruilaunch
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCProxyLatency.exe "C:\Program Files (x86)\RemotePC Viewer\RPCProxyLatency.exe" 0
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" pdfdll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" trayrefresh
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=in verbose
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe
Source: unknown	Process created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe "C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSoundPlayer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCProxyLatency.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\ViewerHostKeyPopup.exe ViewerHostKeyPopup.exe 12
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCodecEngine" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCodecEngine" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCodecEngine" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCodecEngine" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSoundServer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSoundServer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCDesktop" dir=in verbose
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe "C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe" ftfirewall
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 3
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\""
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" failure ViewerService reset= INFINITE actions= restart/2000/restart/2000/restart/2000
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" start ViewerService
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe" /S /ViewerOnly /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" webview
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" zip
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe "C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe" vcredist2017
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" vieweruilaunch
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" pdfdll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe "C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe" trayrefresh
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCDesktop" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCService" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCService" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /u /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll"
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RemotePC" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RemotePC" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewerUIU" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCViewer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePCUI" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" failure ViewerService reset= INFINITE actions= restart/2000/restart/2000/restart/2000
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" start ViewerService
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCodecEngine" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe "C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe" 3
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Users\user\Desktop\RemotePCViewer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RemotePCViewer.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /tlb /register /codebase /nologo /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll"
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCFTViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCFTViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=in verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCUtilityViewer" dir=out verbose
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall show rule name="RPCCoreViewer" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	Process created: C:\ProgramData\RemotePC Viewer\vcredist2017.exe "C:\ProgramData\RemotePC Viewer\vcredist2017.exe" /SILENT /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCodecEngineViewer" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product."
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\RemotePC Viewer\vcredist2017.exe	Process created: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe "C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe" -burn.clean.room="C:\ProgramData\RemotePC Viewer\vcredist2017.exe" -burn.filehandle.attached=680 -burn.filehandle.self=536 /SILENT /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name= "TransferClient ports" dir=out program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe" action=allow protocol=TCP localport=4434-4444
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TransferClient" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product."
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /create /SC DAILY /st 12:00 /TN "RPCPerformanceHealthCheckViewer" /TR "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerformanceDownloader.exe" /rl HIGHEST /ru system
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "1"
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSoundServer" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCDesktop" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCService" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCSuite" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=in verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RemotePC" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCFTViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCFTViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCUtilityViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCUtilityViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewer" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCCoreViewerL" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=in action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c netsh advfirewall firewall add rule name="RPCViewerUIU" enable=yes dir=out action=allow profile=any program="C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe" description="This program is used for File Transfer and is part of RemotePC product."
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe" /S /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll"
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /u /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll"
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe" /tlb /register /codebase /nologo /silent "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll"
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RPCCodecEngineViewer" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCCodecEngine.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product."
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TransferClient" dir=in action=allow program="C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe" enable=yes profile=public,private description="This program is used for remote access between PCs and is part of RemotePCPerformance product."
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /create /SC DAILY /st 12:00 /TN "RPCPerformanceHealthCheckViewer" /TR "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerformanceDownloader.exe" /rl HIGHEST /ru system
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "2"
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "1"
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe" /S /D=C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe /K LFVSCPU
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C netsh advfirewall firewall show rule name="RPCCoreViewerL" dir=out verbose
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe" "2"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe "C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe"
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Process created: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe "C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe" 4

Source: C:\Users\user\Desktop\RemotePCViewer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\RemotePCViewer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	Section loaded: netutils.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: taskschd.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: msisip.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: wshext.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: appxsip.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: opcservices.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Section loaded: esdsip.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: netfxperf.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: pdh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: bitsperf.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: bitsproxy.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: esentprf.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfts.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: utildll.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: tdh.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: msdtcuiu.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: atl.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: msdtcprx.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: mtxclu.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: clusapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: resutils.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: mtxclu.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: ktmw32.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: clusapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: resutils.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: cscapi.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: msscntrs.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfdisk.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: wmiclnt.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfnet.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: browcli.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfos.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfproc.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: sysmain.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: rasctrs.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: tapiperf.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfctrs.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: usbperf.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: tquery.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: cryptdll.dll
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Section loaded: perfproc.dll
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File written: C:\ProgramData\RemotePC Viewer\RPCSettings.ini

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

Window found: window name: TMainForm

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

PE / OLE file has a valid certificate

Source: RemotePCViewer.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: RemotePCViewer.exe

Static file information: File size 74468832 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

File opened: C:\Program Files (x86)\RemotePC Viewer\msvcr100.dll

Data Obfuscation

Registers a DLL

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll"

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\02FAF3E291435468607857694DF5E45B68851868 Blob
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Blob

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-KO9RJ.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\fr-FR\Communications.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDataHandler.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\ProgramData\RemotePC Viewer\dllzip\avformat-59.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-0V1GM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-JVU8F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-917K3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-6PMB7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-S2M2R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-UACP2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-CK3M9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\it-IT\Chat.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\swresample-4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-7UAGT.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Users\user\AppData\Local\Temp\nsq4991.tmp\System.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\aw_sas32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-MPP0F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-0NG9K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-8R17A.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-A6OII.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-O9J54.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-Q7I88.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\gswin32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-97MQD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-7UU51.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-ICH8B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\ja.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-6OI86.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\libx264-164.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-452MU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-1KLVE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-920IQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-U0RK9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-4A5O5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-UNN6Q.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\nl-NL\Communications.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-PT\TransferClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-PBR1P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-1M9R9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-A0N0I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-CGCRV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-C85MN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-85MCA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-UJUI3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-14MLK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-V3EC9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\VirtualAudioDriver\is-IU5NR.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Microsoft.WindowsAPICodePack.Shell.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-2DNLB.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\EasyHook64.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NetworkHandler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-7UTU3.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\text2pdf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\runtimes\win-arm64\native\is-6P337.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-RQRH9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\it-IT\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-D4ODR.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\en\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe	File created: C:\ProgramData\RemotePC Viewer\Spire.Pdf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-A50LN.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\runtimes\win-x64\native\is-UJR0Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-M2Q3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-DV7VQ.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Typography.OpenFont.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\de-DE\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-OHNHT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-IE04B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-GKOT2.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerfViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\runtimes\win-x86\native\is-HRT02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-TA0CA.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\RpcAccessPermissionNotifier.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\gsprint.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-QTSDI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-QKBOG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-QEO49.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-18EN1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-TDM7F.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\log4net.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Ninja.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-930U9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-PR80J.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Communications.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-BR\Chat.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\avformat-60.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-FFANK.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Microsoft.WindowsAPICodePack.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-C3E9D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-PPKUF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-O4J0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-I483O.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\avcodec-60.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-EFKVV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-LQ3ES.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-H332E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-CKH62.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-8FUQS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-LQUR9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\nl-NL\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-60M1U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-LFFDD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-7FD4F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-F44KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-MQC0J.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCSuite.Model.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-TV9OK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-OC2TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-5ASEL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-OL460.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-58FFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-KNLO4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-6D7VI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-OD9CC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\FFMpegDll.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\de-DE\TransferClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-O69K7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-SQ1P2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-91HHP.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-MJ46B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ko-KR\Chat.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\libx265.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-MQGJQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-J3AIT.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NvidiaDecLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\BouncyCastle.Crypto.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\Program Files (x86)\RemotePC Viewer\avfilter-8.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\en\is-01VJB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-SAH4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-11IJO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-K127P.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\NvidiaEncoder.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ja-JP\Communications.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\es-ES\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Users\user\AppData\Local\Temp\is-64VO3.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-MUBUL.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\pt-br.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-HINVM.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\it-IT\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-M44GI.tmp	Jump to dropped file
Source: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe	File created: C:\Windows\Temp\{8FD0A63C-94C4-4CC9-991C-5666F5F32B8C}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\xaudio2_9redist.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-TBF78.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-HNGT2.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\en\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-FM4ER.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\ScribblerOverlay.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerformanceDownloader.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCSuite.Service.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-MIJQ2.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePC.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-6RM71.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-E1A8N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-KMQ2Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-KVUH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-PGLKP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-36S2H.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ShellIcons.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-PT\Chat.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\RemotePCPrintView.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-EKMNB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-8RP8L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-3V22K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-5OU2I.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\ProgramData\RemotePC Viewer\vcredist2017.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\tr-TR\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-0CV6E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-RCJH9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformanceWebLauncher.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-ISOEL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-81MUG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\VirtualAudioDriver\is-SRP3S.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerfAttendedViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-FAK9R.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-P62IV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-M5M1L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-13OEI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-D8OUL.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Emoji.Wpf.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\PluginInstaller.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\gswin32c.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\de-DE\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-BL792.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-ID418.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-ESK3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-AUSJ1.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferServer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-A9ISU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-G1R64.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\TransferClient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-DBMLK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-3FL9J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-G8KC7.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-BR\Communications.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\Program Files (x86)\RemotePC Viewer\avcodec-59.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\es-ES\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-L5CAE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePC.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-THMBJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-4HNMN.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\fr-FR\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-BBA36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-87NMJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-QBP8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-FJMKO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-S771Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-9BNCF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-QPFEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-ODKCK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt\is-PC0JR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-UT1A9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-QE1RR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-4QR2S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-3AJHM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-5K0NM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-R8BJO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-VAD0P.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-BR\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\tr-TR\TransferClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-198BN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-N449I.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCBHS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-ISGJQ.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Users\user\AppData\Local\Temp\nsq4991.tmp\DotNetChecker.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\es-ES\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\IntelVplDll.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-PGAVR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-O3G27.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\pt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-MT80M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-5B79K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\en\is-S7VG8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-HM97H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-VD23D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-HMF9M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-MLJID.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\RpcAccessNotifier.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\de\is-98K1B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ja-JP\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-E9H2H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-VCOCU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-37S8Q.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\RpcStickyNotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-IG6RU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-9P7QS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-A19UK.tmp	Jump to dropped file
Source: C:\ProgramData\RemotePC Viewer\vcredist2017.exe	File created: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\nl\is-CT3UU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-U8LH9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\avutil-58.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-P8U9J.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ja-JP\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\AWSSDK.S3.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\nl-NL\TransferClient.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-KPID3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-HHU1T.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCAuthProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-NJJEA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-714M8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-N1FOG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-PGMFO.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\it.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Chat.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-6OUNF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-QE9B6.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\RpcUtility.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\fr-FR\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\WmfEncDecLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Users\user\AppData\Local\Temp\nsq4991.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ko-KR\TransferClient.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\pt-PT\Communications.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCCodecEngine.exe	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\swscale-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-BP3RU.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\Microsoft.Xaml.Behaviors.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\RPCDnD.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-V8S36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-KOUQ8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-FHEG5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-BHG0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-K1D3H.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\RemotePCPrinting.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-ECVU9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\HardwareMonitorUtility.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-D0AI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-FV6IA.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\AWSSDK.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Users\user\AppData\Local\Temp\is-64VO3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-MFUIV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-6KGC7.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\Typography.GlyphLayout.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-B9I7E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-IEQ61.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Users\user\AppData\Local\Temp\nsq4991.tmp\LogEx.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\ko-KR\Communications.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\es\is-LCOUG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-HIBUK.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\gsdll32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-5OV7B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\fr\is-FJ0NE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\uninst_printer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\pt-br\is-OEU1B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\libvpl.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\uninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-2F2FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-3UTR0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ja\is-MQBJG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-0K77K.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Tools\tr-TR\Chat.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\legacy\is-6BGSS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-4D63O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\it\is-SVV1Q.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Users\user\AppData\Local\Temp\nsq4991.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-QADP1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\is-IIU0T.tmp	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\Resources\fr.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePlugins.exe	File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcApp\p2p-win.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\Program Files (x86)\RemotePC Viewer\ko\is-L2OHK.tmp	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe	File created: C:\ProgramData\RemotePC Viewer\Spire.Pdf.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\ProgramData\RemotePC Viewer\dllzip\avformat-59.dll	Jump to dropped file
Source: C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe	File created: C:\ProgramData\RemotePC Viewer\vcredist2017.exe	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\ProgramData\RemotePC Viewer\vcredist2017.exe	File created: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe			Jump to dropped file
Source: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe	File created: C:\Windows\Temp\{8FD0A63C-94C4-4CC9-991C-5666F5F32B8C}\.ba\wixstdba.dll			Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RemotePCPerformancePrinter.exe

File created: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RpcPrinter\Xtra\PD\PDF-XChange Viewer Settings.dat

Jump to dropped file

Creates install or setup log file

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe

File created: C:\ProgramData\RemotePC Performance Viewer\Logs\PerformanceSetup.log

Boot Survival

Sets file extension default program settings to executables

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\REMOTEPC7653\Shell\Open\command C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe %1

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /create /SC DAILY /st 12:00 /TN "RPCPerformanceHealthCheckViewer" /TR "C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance\RPCPerformanceDownloader.exe" /rl HIGHEST /ru system

Creates or modifies windows services

Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RemotePC Viewer.lnk
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RemotePC Viewer
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RemotePC Viewer\RemotePCViewer.lnk
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RemotePC Viewer\Uninstall RemotePC Viewer.lnk
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePCViewer.lnk

Source: C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\system32\sc.exe" create ViewerService start=auto binPath= "\"C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe\""

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress,PNPDeviceID FROM Win32_NetworkAdapter WHERE MACAddress IS NOT NULL AND PNPDeviceID IS NOT NULL
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress,PNPDeviceID FROM Win32_NetworkAdapter WHERE MACAddress IS NOT NULL AND PNPDeviceID IS NOT NULL

Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Memory allocated: 2360000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Memory allocated: 2580000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Memory allocated: 4580000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Memory allocated: 27D3DBD0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Memory allocated: 27D57620000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Memory allocated: 2669DEE0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Memory allocated: 266B7950000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Memory allocated: 25F5F980000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Memory allocated: 25F79450000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Memory allocated: 1720000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Memory allocated: 18A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Memory allocated: 38A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Memory allocated: 2940D930000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Memory allocated: 294271C0000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Thread delayed: delay time: 1800000
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599871
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599747
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599601
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599403
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599300
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599175
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 599047
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 598935
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Thread delayed: delay time: 598831

Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Window / User API: threadDelayed 1513
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe	Window / User API: threadDelayed 7954

Source: C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe TID: 5860	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe TID: 6268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe TID: 4004	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6832	Thread sleep count: 172 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6832	Thread sleep count: 293 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6808	Thread sleep time: -7500000s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6808	Thread sleep time: -43200000s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6808	Thread sleep time: -3000000s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe TID: 4284	Thread sleep count: 243 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe TID: 4284	Thread sleep count: 33 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6808	Thread sleep count: 43 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe TID: 6808	Thread sleep time: -43000s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe TID: 4284	Thread sleep count: 142 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 1540	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599871s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 7028	Thread sleep count: 1513 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 7028	Thread sleep count: 7954 > 30
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599747s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599601s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599403s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599300s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599175s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -599047s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -598935s >= -30000s
Source: C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe TID: 3484	Thread sleep time: -598831s >= -30000s

Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe	Process token adjusted: Debug

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	11 Windows Service	11 Windows Service	122 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Process Injection	21 Disable or Modify Tools	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	331 Virtualization/Sandbox Evasion	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Regsvr32	LSA Secrets	331 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	12 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner
C:\Program Files (x86)\RemotePC Viewer\MultiSelectTreeView.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\is-UJUI3.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-64VO3.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-64VO3.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\AWSSDK.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\AWSSDK.S3.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\CbtHook.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\EditableTextBlock.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\GalaSoft.MvvmLight.Extras.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\GalaSoft.MvvmLight.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\GongSolutions.WPF.DragDrop.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\KeyBoardMouseInputHandler.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Microsoft.Practices.ServiceLocation.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.WinForms.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.Wpf.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Microsoft.Win32.TaskScheduler.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\MicrosoftEdgeWebview2Setup.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Ninja.WebSockets.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Odyssey.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\PreUninstall.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCCredentialProvider.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCDownloader.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCFireWallRule.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCGAE.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCProxyLatency.exe (copy)	4%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPCViewerUIU.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RPDUILaunch.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RemotePCLauncher.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RemotePCPerformance.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RemotePCShortcut.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RpcDND_Console.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\RpcDnDLibrary.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Spire.License.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\System.Windows.Interactivity.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\UnZip32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\ViewerHostKeyPopup.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\ViewerService.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\VirtualAudioDriver\RemotePCVad.sys (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\VirtualAudioDriver\devcon.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\WindowsHook.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\WpfAnimatedGif.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\Zip32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\avcodec-58.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\avfilter-7.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\avformat-58.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\avutil-56.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\aw_sas32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCDownloader.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCFTHost.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCFTViewer.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCUtilityHost.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCUtilityViewer.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RPCViewerUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RemotePCLauncher.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\RemotePCUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\de\ViewerHostKeyPopup.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\dotNetFx45_Full_setup.exe (copy)	3%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\en\RPCViewerUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\en\RemotePCUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCDownloader.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCFTHost.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCFTViewer.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCUtilityHost.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCUtilityViewer.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RPCViewerUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RemotePCLauncher.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\RemotePCUIU.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\RemotePC Viewer\es\ViewerHostKeyPopup.resources.dll (copy)	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
london.remotepc.com	217.146.29.226	true	false	unknown
marseille.remotepc.com	188.172.245.6	true	false	unknown
lima.remotepc.com	188.172.252.134	true	false	unknown
iddallas1.remotepc.com	148.51.139.132	true	false	unknown
donewyork3.remotepc.com	209.97.151.224	true	false	unknown
bluffdale.remotepc.com	107.182.238.163	true	false	unknown
bangalore4.remotepc.com	165.232.185.68	true	false	unknown
atlanta.remotepc.com	162.250.7.38	true	false	unknown
www1.remotepc.com	64.90.202.245	true	false	unknown
dallas.remotepc.com	45.79.25.53	true	false	unknown
dosfo2.remotepc.com	159.89.133.27	true	false	unknown
dosfo1.remotepc.com	167.99.101.140	true	false	unknown
medellin.remotepc.com	131.100.1.134	true	false	unknown
lansing.remotepc.com	67.225.163.108	true	false	unknown
sanjose.remotepc.com	92.38.149.190	true	false	unknown
charlotte.remotepc.com	209.136.192.14	true	false	unknown
bucharest.remotepc.com	185.40.235.89	true	false	unknown
sydney.remotepc.com	37.252.240.226	true	false	unknown
secaucus.remotepc.com	8.36.36.55	true	false	unknown
userfornia.remotepc.com	54.193.137.147	true	false	unknown
taipei.remotepc.com	188.172.208.162	true	false	unknown
idchicago1.remotepc.com	66.63.166.194	true	false	unknown
donewyork2.remotepc.com	159.89.224.233	true	false	unknown
donewyork1.remotepc.com	159.89.239.54	true	false	unknown
neworleans.remotepc.com	162.247.71.74	true	false	unknown
orlando.remotepc.com	199.168.186.114	true	false	unknown
iddetroit.remotepc.com	66.63.166.234	true	false	unknown
raleigh.remotepc.com	104.225.1.48	true	false	unknown
download.remotepc.com	104.22.40.86	true	false	unknown
auckland.remotepc.com	45.64.60.228	true	false	unknown
memphis.remotepc.com	69.7.102.178	true	false	unknown
la4.remotepc.com	162.220.221.181	true	false	unknown
hanoi.remotepc.com	203.162.172.94	true	false	unknown
osaka.remotepc.com	213.227.170.162	true	false	unknown
bucharest1.remotepc.com	188.172.254.166	true	false	unknown
idlondon.remotepc.com	207.199.137.191	true	false	unknown
santiago.remotepc.com	94.16.5.134	true	false	unknown
idmadrid.remotepc.com	216.107.21.85	true	false	unknown
newyork.remotepc.com	38.140.2.186	true	false	unknown
static.remotepc.com	172.67.37.123	true	false	unknown
bangkok.remotepc.com	217.146.0.134	true	false	unknown
tampa.remotepc.com	23.111.180.250	true	false	unknown
frankfurt.remotepc.com	216.107.26.118	true	false	unknown
azchicago.remotepc.com	92.38.176.102	true	false	unknown
iddenver.remotepc.com	72.26.117.57	true	false	unknown
albany.remotepc.com	64.246.134.150	true	false	unknown
dubai.remotepc.com	unknown	unknown	false	unknown
riverside.remotepc.com	unknown	unknown	false	unknown
montreal.remotepc.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
209.97.151.224	donewyork3.remotepc.com	United States	14061	DIGITALOCEAN-ASNUS	false
66.63.166.234	iddetroit.remotepc.com	United States	8100	ASN-QUADRANET-GLOBALUS	false
188.172.218.50	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
162.220.221.181	la4.remotepc.com	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
162.220.221.182	unknown	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
159.89.239.54	donewyork1.remotepc.com	United States	14061	DIGITALOCEAN-ASNUS	false
38.122.20.234	unknown	United States	174	COGENT-174US	false
206.41.193.194	unknown	United States	17054	AS17054US	false
72.26.124.47	unknown	United States	7296	ALCHEMYNETUS	false
208.71.141.201	unknown	United States	40281	QWKNETUS	false
52.183.209.183	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.107.21.85	idmadrid.remotepc.com	United States	54103	MODMCUS	false
148.51.139.132	iddallas1.remotepc.com	United States	62947	IMDC-AS1US	false
45.79.25.53	dallas.remotepc.com	United States	63949	LINODE-APLinodeLLCUS	false
5.188.34.61	unknown	Russian Federation	199524	GCOREAT	false
66.63.166.194	idchicago1.remotepc.com	United States	8100	ASN-QUADRANET-GLOBALUS	false
159.89.224.233	donewyork2.remotepc.com	United States	14061	DIGITALOCEAN-ASNUS	false
188.172.254.166	bucharest1.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
13.244.131.0	unknown	United States	16509	AMAZON-02US	false
217.146.6.130	unknown	Austria	199159	DATASIXpoweredbyANXAT	false
107.182.238.163	bluffdale.remotepc.com	United States	32780	HOSTINGSERVICES-INCUS	false
213.227.173.26	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
162.220.51.104	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false
104.22.40.86	download.remotepc.com	United States	13335	CLOUDFLARENETUS	false
199.168.186.114	orlando.remotepc.com	United States	33182	DIMENOCUS	false
165.232.185.68	bangalore4.remotepc.com	United States	22255	ALLEGHENYHEALTHNETWORKUS	false
209.216.230.75	unknown	United States	21581	M5HOSTINGUS	false
165.22.215.85	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
188.172.252.134	lima.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
37.252.232.90	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
188.172.245.6	marseille.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
37.252.253.90	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
37.252.247.94	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
92.38.176.102	azchicago.remotepc.com	Austria	202422	GHOSTRU	false
203.162.172.94	hanoi.remotepc.com	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
37.252.224.54	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
54.193.137.147	userfornia.remotepc.com	United States	16509	AMAZON-02US	false
35.189.151.77	unknown	United States	15169	GOOGLEUS	false
37.252.231.106	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
52.60.68.8	unknown	United States	16509	AMAZON-02US	false
217.146.28.162	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
217.146.0.134	bangkok.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
188.172.212.54	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
35.203.92.233	unknown	United States	15169	GOOGLEUS	false
188.172.208.162	taipei.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
213.227.170.162	osaka.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
149.14.224.130	unknown	United States	174	COGENT-174US	false
216.107.26.118	frankfurt.remotepc.com	United States	54103	MODMCUS	false
217.146.31.98	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
162.220.222.150	unknown	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
217.146.21.46	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
209.166.139.98	unknown	United States	17054	AS17054US	false
37.252.240.226	sydney.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
162.250.3.58	unknown	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
178.255.153.38	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
18.218.244.83	unknown	United States	16509	AMAZON-02US	false
167.99.101.140	dosfo1.remotepc.com	United States	14061	DIGITALOCEAN-ASNUS	false
74.112.192.176	unknown	United States	25649	AYERA-ASUS	false
64.90.202.245	www1.remotepc.com	United States	13649	ASN-VINSUS	false
159.89.133.27	dosfo2.remotepc.com	United States	14061	DIGITALOCEAN-ASNUS	false
45.79.47.207	unknown	United States	63949	LINODE-APLinodeLLCUS	false
35.203.145.135	unknown	United States	15169	GOOGLEUS	false
217.146.29.228	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
217.146.29.229	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
217.146.29.226	london.remotepc.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
104.225.1.48	raleigh.remotepc.com	United States	36236	NETACTUATEUS	false
67.225.163.108	lansing.remotepc.com	United States	32244	LIQUIDWEBUS	false
162.250.7.38	atlanta.remotepc.com	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
95.154.211.18	unknown	United Kingdom	20860	IOMART-ASGB	false
216.59.31.140	unknown	United States	53360	CUMULUS	false
8.36.36.55	secaucus.remotepc.com	United States	12025	IMDC-AS12025US	false
209.136.192.14	charlotte.remotepc.com	United States	11402	CCCAS-1US	false
40.86.230.171	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
148.66.233.39	unknown	United States	13649	ASN-VINSUS	false
69.7.102.178	memphis.remotepc.com	United States	17054	AS17054US	false
172.102.240.6	unknown	United States	54623	ONE-INTERNET-AMERICAUS	false
188.172.192.66	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
45.56.75.145	unknown	United States	63949	LINODE-APLinodeLLCUS	false
52.29.180.244	unknown	United States	16509	AMAZON-02US	false
23.111.180.250	tampa.remotepc.com	United States	29802	HVC-ASUS	false
188.172.233.142	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
51.137.134.97	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
66.181.0.154	unknown	United States	21623	SPACELINKUS	false
35.192.32.146	unknown	United States	15169	GOOGLEUS	false
38.140.2.194	unknown	United States	174	COGENT-174US	false
162.250.2.30	unknown	United States	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
217.146.11.38	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
172.67.37.123	static.remotepc.com	United States	13335	CLOUDFLARENETUS	false
23.253.213.184	unknown	United States	19994	RACKSPACEUS	false
45.64.60.228	auckland.remotepc.com	New Zealand	132692	GLOBICOMLIMITED-AS-APGlobiComLimitedNZ	false
131.100.1.134	medellin.remotepc.com	Panama	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
94.16.5.134	santiago.remotepc.com	Germany	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
37.252.225.154	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
64.246.134.150	albany.remotepc.com	United States	22302	INOCUS	false
207.199.137.191	idlondon.remotepc.com	United States	54103	MODMCUS	false
188.172.217.166	unknown	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
72.26.117.57	iddenver.remotepc.com	United States	7296	ALCHEMYNETUS	false
38.140.2.186	newyork.remotepc.com	United States	174	COGENT-174US	false
35.241.203.75	unknown	United States	15169	GOOGLEUS	false
207.65.10.14	unknown	United States	6203	ISDN-NETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534294
Start date and time:	2024-10-15 17:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	177
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	RemotePCViewer.exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@240/436@49/362
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\AppData\Local\Temp\is-575VQ.tmp\RemotePCViewer.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	3529E7E86ABF647258D259828D6AFD3F
SHA1:	A835AF728B2B5A36FF94BC3A549F44D9FF295969
SHA-256:	7CDB72BA844B375CE10E19577E3F7A943612EB69C860F42E25EFB7B01AF80FB7
SHA-512:	6D26CA428D31460B5DD822754EEF0811E1F94B5C60ABD41032A1C4DC273BDEC28103ACBEAA3957057067807327DF3DC83E8056EC1D747FCCD6B75D562DBEBBED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.................................A...O........................-..........0...T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................u.......H........)..P............#................................................(V.....-.r...pr...psW...z.-.ri..pr{..psW...z..oX...(....2.sY...(......-.r...pr...psW...z.(....(Z...r...pr...po[.....-.r...pr...psW...z.-.ri..pr...psW...z..oX...(....2.sY...(........0..{........-.r...pr...psW...z.......... .#Eg}...... ....}...... ...}...... vT2.}......+.....(......@X....i.@Y1.....i.Y...ij.jZ(....*..0...........@........(\.........(]..... .......8/.....8.(].......(....+%....(.....@

Process:	C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6853
Entropy (8bit):	5.456763995497514
Encrypted:	false
SSDEEP:
MD5:	BCFD44B83395B59EC94781F7BBD2EFDA
SHA1:	AFD51DEDA62F7BF614458A78EFB8A1C76EF2AA1F
SHA-256:	AE6F4C157AE3706FA21338D18462B53F4832B5418FEE9E0981ED14EAF22D7E63
SHA-512:	B63F6962668E900B04D03C95272790304E231F603795848421A4A56A3F4558E0DCAB11A1B8A83CAF199B1B51049123D1BC0F8B670A2E5B313808C2A53EBC0218
Malicious:	false
Reputation:	unknown
Preview:	[0304:1AB8][2024-10-15T11:44:56]i001: Burn v3.10.4.4718, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{A4747E69-AC5B-4B1F-B646-4C4287E209B1}\.cr\vcredist2017.exe..[0304:1AB8][2024-10-15T11:44:56]i009: Command Line: '"-burn.clean.room=C:\ProgramData\RemotePC Viewer\vcredist2017.exe" -burn.filehandle.attached=680 -burn.filehandle.self=536 /SILENT /VERYSILENT /SUPPRESSMSGBOXES /NORESTART'..[0304:1AB8][2024-10-15T11:44:56]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\ProgramData\RemotePC Viewer\vcredist2017.exe'..[0304:1AB8][2024-10-15T11:44:56]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\ProgramData\RemotePC Viewer\'..[0304:1AB8][2024-10-15T11:44:57]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241015114457.log'..[0304:1AB8][2024-10-15T11:44:57]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2017 Redistributable (x64) - 14.16

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	2.914952004241742
Encrypted:	false
SSDEEP:
MD5:	52DF6A809F7BA7A7ABF1252F292B4E25
SHA1:	3703531F953FE8B6FE72931BECFCFEC5C146669A
SHA-256:	3C5BA44D2CB8993015BCA60B919DE1427E1170BAEF4C531DB12486A92DA536B8
SHA-512:	1E848B681930F3B1397175F9AB4C1B1B8B7F53D646A91DFD10B7DCF31DD2CBC790C5F6A7D61E01BFC80ADCF519E15D61334559CB67799F03B4797CFAFBCC1D8E
Malicious:	false
Reputation:	unknown
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////....

Process:	C:\ProgramData\RemotePC Viewer\vcredist2017.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	902528
Entropy (8bit):	7.545187442050241
Encrypted:	false
SSDEEP:
MD5:	77E7ADAC36B6C0AA3497AB855328742B
SHA1:	B14C603C4C5C7FAE6E64AE1A3ADB73BD2C276DFA
SHA-256:	8BDB6303852E0321A48156565A5F09A3ECD9F327123542453E0C086D1A9D0AFA
SHA-512:	5CE7A058DA003D551373367055760ED49492DEAB71AC400E39F1AD285139C0D6EA7394C2C2210E6977D123AE4BDBABAE9CDC94B77726DED07268EE41765C2F54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;..............$...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

Entrypoint:	0x40a5f8
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	21/01/2022 01:00:00 22/01/2025 00:59:59
Subject Chain	CN="IDrive, Inc.", O="IDrive, Inc.", L=Calabasas, S=California, C=US
Version:	3
Thumbprint MD5:	16AFD7CB5F7CD59340C1C4312C9CD236
Thumbprint SHA-1:	8D977609BF953593A78AD37D8334DD0EDADD4E43
Thumbprint SHA-256:	7A250FE138ED4CD8A306C562811229BC96D5102B7B2AF788EB6C43E11B59295D
Serial:	0DB2040B04E96718233A8123F8949B36

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x27e1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4702040	0x2da0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9d30	0x9e00	c3bd95c4b1a8e5199981e0d9b45fd18c	False	0.6052709651898734	data	6.631765876950794	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x250	0x400	1ee71d84f1c77af85f1f5c278f880572	False	0.306640625	data	2.751820662285145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe8c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x27e1c	0x28000	98e3a24ff5766cd2cc81e84b5e847a83	False	0.40101318359375	data	5.7066187962003685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RemotePCViewer.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\Program Files (x86)\RemotePC Viewer\AWSSDK.Core.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\AWSSDK.S3.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\BSUtility.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\CbtHook.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\D3DX9_43.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\EditableTextBlock.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\GalaSoft.MvvmLight.Extras.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\GalaSoft.MvvmLight.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\GongSolutions.WPF.DragDrop.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\KeyBoardMouseInputHandler.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.Practices.ServiceLocation.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.VC90.CRT.manifest (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.Core.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.WinForms.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.Web.WebView2.Wpf.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Microsoft.Win32.TaskScheduler.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\MicrosoftEdgeWebview2Setup.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\MultiSelectTreeView.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Newtonsoft.Json.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Ninja.WebSockets.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Odyssey.dll (copy)

C:\Program Files (x86)\RemotePC Viewer\Path.INI

C:\Program Files (x86)\RemotePC Viewer\PreUninstall.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\RPCCertificate.log

C:\Program Files (x86)\RemotePC Viewer\RPCCmdViewer.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewer.exe (copy)

C:\Program Files (x86)\RemotePC Viewer\RPCCoreViewerL.exe (copy)

Windows Analysis Report
RemotePCViewer.exe

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x114a4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.5161290322580645
RT_ICON	0x1178c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.6013513513513513
RT_ICON	0x118b4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.6122068230277186
RT_ICON	0x1275c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7333032490974729
RT_ICON	0x13004	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.7167630057803468
RT_ICON	0x1356c	0x6ae1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.999049742333979
RT_ICON	0x1a050	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.19065716313734768
RT_ICON	0x2a878	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.29109733025015766
RT_ICON	0x33d20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.42064315352697096
RT_ICON	0x362c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.47607879924953095
RT_ICON	0x37370	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.475177304964539
RT_STRING	0x377d8	0x2f2	data			0.35543766578249336
RT_STRING	0x37acc	0x30c	data			0.3871794871794872
RT_STRING	0x37dd8	0x2ce	data			0.42618384401114207
RT_STRING	0x380a8	0x68	data			0.75
RT_STRING	0x38110	0xb4	data			0.6277777777777778
RT_STRING	0x381c4	0xae	data			0.5344827586206896
RT_RCDATA	0x38274	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x382a0	0xa0	data	English	United States	0.65625
RT_VERSION	0x38340	0x4f4	data	English	United States	0.2823343848580442
RT_MANIFEST	0x38834	0x5e8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4252645502645503

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre