Rainst.exe registry modification
We have observed that the LMIRfsClientNP service was disabled due to a registry modification performed by the process Rainst.exe. Our SIEM solution has alerted us to this activity. Questions: Is t...
Forum Discussion
Hi kareemsamir
Welcome to the Community, and apologies for the delay as we followed up with our team.
Rainst.exe is part of LogMeIn host software, as well as LMIRfsClientNP.
LMIRfsClientNP is not a Windows 32 service. It is part of the remote file system driver, installed with LogMeIn host software and used for the "Connect Drives" feature during Remote Control session. It's possible the LogMeIn software updated itself and rainst.exe had to stop this driver during update.
Hope this helps!
