Analysis
-
max time kernel
146s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 03:31
Static task
static1
Behavioral task
behavioral1
Sample
88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe
-
Size
5.6MB
-
MD5
88d486373f3a8a2cafabaf9b4d2d5249
-
SHA1
746047d4cf8b304cea2bc0dcfcc29b630fdcaae1
-
SHA256
4434da52be03e1aab6dfea806a29a1adf6d413779375c616193fbe7c6b40c63c
-
SHA512
d481781cfb9dc516d30dd46786ccb227ebefcfada3b42a915de9170384007da9ce50d4634ac6fa9a7983fb6cb1aac3b839e189be0056356583c7ad445ab2e331
-
SSDEEP
98304:n3JjeVE63WQbNYt7DKDKsOzPsLVYmtAdN1AAbMoxTakNTllwmEI8+kgRN:n3JyVlWQb6+DKDahSfb9xe0lV8tgv
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2836 attrib.exe 2560 attrib.exe -
Deletes itself 1 IoCs
pid Process 1908 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 2068 rfusclient.exe 2092 rutserv.exe 1068 rfusclient.exe 1252 rutserv.exe 1652 rfusclient.exe 2988 rutserv.exe 2596 rutserv.exe 2436 rfusclient.exe 2484 rfusclient.exe 1868 rfusclient.exe -
Loads dropped DLL 21 IoCs
pid Process 2476 MsiExec.exe 1928 MsiExec.exe 1928 MsiExec.exe 1928 MsiExec.exe 1928 MsiExec.exe 1928 MsiExec.exe 1928 MsiExec.exe 2068 rfusclient.exe 2068 rfusclient.exe 2068 rfusclient.exe 2068 rfusclient.exe 2068 rfusclient.exe 1068 rfusclient.exe 1068 rfusclient.exe 1068 rfusclient.exe 1068 rfusclient.exe 2476 MsiExec.exe 1652 rfusclient.exe 1652 rfusclient.exe 1652 rfusclient.exe 1652 rfusclient.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll msiexec.exe File opened for modification C:\Program Files (x86)\Remote Manipulator System - Server attrib.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\help.chm msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll msiexec.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe msiexec.exe File opened for modification C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC11D.tmp msiexec.exe File opened for modification C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f76befe.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC22A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC2F5.tmp msiexec.exe File created C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe msiexec.exe File opened for modification C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe msiexec.exe File opened for modification C:\Windows\Installer\f76befb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID465.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76befe.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC11E.tmp msiexec.exe File created C:\Windows\Installer\f76bf00.msi msiexec.exe File opened for modification C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe msiexec.exe File created C:\Windows\Installer\f76befb.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1920 PING.EXE 2152 PING.EXE -
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" rfusclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" rfusclient.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rfusclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rfusclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" rfusclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" rfusclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" rfusclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rfusclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" rfusclient.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F1-5211-11DF-94AF-0026B977EEAA}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Filter" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Version = "83951616" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer\ = "WebM.VP8Encoder.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\PackageName = "rms.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FriendlyName = "Xiph.Org Vorbis Decoder" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "WebM.VP8Encoder" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Decoder Filter" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\ = "VP8 Decoder Filter Type Library" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Property Page" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\PackageCode = "ED03084D7EC734C4DAE96D93DA017B5D" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\ = "Xiph.Org Vorbis Decoder" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000700000008000000031706933080000000000000002000000000000000000000030747933000000007000000090000000317479330000000070000000a00000007669647300001000800000aa00389b715650383000001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b71 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\ = "VP8 Encoder Filter Type Library" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1\CLSID\ = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70\Remote_Office_Manager msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisEncoder.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\CLSID = "{05A1D945-A794-44EF-B41A-2F851A117155}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib\ = "{ED3110F4-5211-11DF-94AF-0026B977EEAA}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\ = "Xiph.Org Vorbis Encoder" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "Webm.VP8Decoder.1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1\ = "WebM VP8 Decoder Filter" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\ = "WebM VP8 Encoder Filter" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CurVer MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32 MsiExec.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1920 PING.EXE 2152 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3048 msiexec.exe 3048 msiexec.exe 2596 rutserv.exe 2596 rutserv.exe 2436 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1868 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2896 msiexec.exe Token: SeIncreaseQuotaPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeSecurityPrivilege 3048 msiexec.exe Token: SeCreateTokenPrivilege 2896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2896 msiexec.exe Token: SeLockMemoryPrivilege 2896 msiexec.exe Token: SeIncreaseQuotaPrivilege 2896 msiexec.exe Token: SeMachineAccountPrivilege 2896 msiexec.exe Token: SeTcbPrivilege 2896 msiexec.exe Token: SeSecurityPrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeLoadDriverPrivilege 2896 msiexec.exe Token: SeSystemProfilePrivilege 2896 msiexec.exe Token: SeSystemtimePrivilege 2896 msiexec.exe Token: SeProfSingleProcessPrivilege 2896 msiexec.exe Token: SeIncBasePriorityPrivilege 2896 msiexec.exe Token: SeCreatePagefilePrivilege 2896 msiexec.exe Token: SeCreatePermanentPrivilege 2896 msiexec.exe Token: SeBackupPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeShutdownPrivilege 2896 msiexec.exe Token: SeDebugPrivilege 2896 msiexec.exe Token: SeAuditPrivilege 2896 msiexec.exe Token: SeSystemEnvironmentPrivilege 2896 msiexec.exe Token: SeChangeNotifyPrivilege 2896 msiexec.exe Token: SeRemoteShutdownPrivilege 2896 msiexec.exe Token: SeUndockPrivilege 2896 msiexec.exe Token: SeSyncAgentPrivilege 2896 msiexec.exe Token: SeEnableDelegationPrivilege 2896 msiexec.exe Token: SeManageVolumePrivilege 2896 msiexec.exe Token: SeImpersonatePrivilege 2896 msiexec.exe Token: SeCreateGlobalPrivilege 2896 msiexec.exe Token: SeShutdownPrivilege 2836 msiexec.exe Token: SeIncreaseQuotaPrivilege 2836 msiexec.exe Token: SeCreateTokenPrivilege 2836 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2836 msiexec.exe Token: SeLockMemoryPrivilege 2836 msiexec.exe Token: SeIncreaseQuotaPrivilege 2836 msiexec.exe Token: SeMachineAccountPrivilege 2836 msiexec.exe Token: SeTcbPrivilege 2836 msiexec.exe Token: SeSecurityPrivilege 2836 msiexec.exe Token: SeTakeOwnershipPrivilege 2836 msiexec.exe Token: SeLoadDriverPrivilege 2836 msiexec.exe Token: SeSystemProfilePrivilege 2836 msiexec.exe Token: SeSystemtimePrivilege 2836 msiexec.exe Token: SeProfSingleProcessPrivilege 2836 msiexec.exe Token: SeIncBasePriorityPrivilege 2836 msiexec.exe Token: SeCreatePagefilePrivilege 2836 msiexec.exe Token: SeCreatePermanentPrivilege 2836 msiexec.exe Token: SeBackupPrivilege 2836 msiexec.exe Token: SeRestorePrivilege 2836 msiexec.exe Token: SeShutdownPrivilege 2836 msiexec.exe Token: SeDebugPrivilege 2836 msiexec.exe Token: SeAuditPrivilege 2836 msiexec.exe Token: SeSystemEnvironmentPrivilege 2836 msiexec.exe Token: SeChangeNotifyPrivilege 2836 msiexec.exe Token: SeRemoteShutdownPrivilege 2836 msiexec.exe Token: SeUndockPrivilege 2836 msiexec.exe Token: SeSyncAgentPrivilege 2836 msiexec.exe Token: SeEnableDelegationPrivilege 2836 msiexec.exe Token: SeManageVolumePrivilege 2836 msiexec.exe Token: SeImpersonatePrivilege 2836 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 2240 wrote to memory of 1936 2240 88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe 28 PID 1936 wrote to memory of 1920 1936 cmd.exe 30 PID 1936 wrote to memory of 1920 1936 cmd.exe 30 PID 1936 wrote to memory of 1920 1936 cmd.exe 30 PID 1936 wrote to memory of 1920 1936 cmd.exe 30 PID 1936 wrote to memory of 2900 1936 cmd.exe 31 PID 1936 wrote to memory of 2900 1936 cmd.exe 31 PID 1936 wrote to memory of 2900 1936 cmd.exe 31 PID 1936 wrote to memory of 2900 1936 cmd.exe 31 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2896 1936 cmd.exe 32 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 2836 1936 cmd.exe 34 PID 1936 wrote to memory of 3024 1936 cmd.exe 35 PID 1936 wrote to memory of 3024 1936 cmd.exe 35 PID 1936 wrote to memory of 3024 1936 cmd.exe 35 PID 1936 wrote to memory of 3024 1936 cmd.exe 35 PID 1936 wrote to memory of 2152 1936 cmd.exe 36 PID 1936 wrote to memory of 2152 1936 cmd.exe 36 PID 1936 wrote to memory of 2152 1936 cmd.exe 36 PID 1936 wrote to memory of 2152 1936 cmd.exe 36 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 1936 wrote to memory of 2848 1936 cmd.exe 37 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 2476 3048 msiexec.exe 38 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 1928 3048 msiexec.exe 39 PID 3048 wrote to memory of 2068 3048 msiexec.exe 40 PID 3048 wrote to memory of 2068 3048 msiexec.exe 40 PID 3048 wrote to memory of 2068 3048 msiexec.exe 40 PID 3048 wrote to memory of 2068 3048 msiexec.exe 40 PID 2068 wrote to memory of 2092 2068 rfusclient.exe 41 PID 2068 wrote to memory of 2092 2068 rfusclient.exe 41 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2836 attrib.exe 2560 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88d486373f3a8a2cafabaf9b4d2d5249_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\PING.EXEping -n 1 -w 5000 ya.ru3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1920
-
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE/SYSTEM/Remote Manipulator System" /f3⤵
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2152
-
-
C:\Windows\SysWOW64\msiexec.exeMsiExec /I "rms.msi" /qn3⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib +S +H +r "C:\Program Files\Remote Manipulator System - Server"3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2836
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Installer\Products\85809A11BB0485842AADAC4659 5B9E70" /f3⤵
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\Windows\SysWOW64\attrib.exeattrib +S +H +r "C:\Program Files (x86)\Remote Manipulator System - Server"3⤵
- Sets file to hidden
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2560
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Un install\{11A90858-40BB-4858-A2DA-CA6495B5E907}" /f3⤵
- System Location Discovery: System Language Discovery
PID:3004
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\In staller\UserData\S-1-5-18\Products\85809A11BB0485842AADAC46595B9E70\Insta llProperties" /f3⤵
- System Location Discovery: System Language Discovery
PID:2492
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Installer\Products\85809A11BB0485842AADAC465 95B9E70" /f3⤵
- System Location Discovery: System Language Discovery
PID:852
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1908
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A73C24295452A3C70FC451818C57F8812⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89C06C47AD24A181D9DFD7D54FF0BB5F M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1928
-
-
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2092
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1068 -
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1652 -
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2436 -
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:1868
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD52b48dfaf374f619aec3887e0b2edb464
SHA1b85ef251d1fed1848df05806ef54c5626a068c24
SHA2566f07cc1509416de4711483a7eed56c50ff999fd2c9430eedd0709b5d51248620
SHA5126f840a17c4646989291667e63db4de85033e32b623160e5f935821a1f1b65ba83b2a2e0a8ddd14c36561df876a4578324b6cd5d05a33d8b5e192f3536df52d1a
-
Filesize
33KB
MD5fb0fb6001e3efdfc29d79e045ada9798
SHA1fb8fe198211634fa9a52866c8f607bdb6b8a4523
SHA2567ec3ff20d8ac7514dbdbc861487cc054ba8243d95ee801cfd888ea1e47d5d0ba
SHA5128e38b464399a6375962eaa671eaca38aed96774586d4b2818fa656e6adc1211ff6612073bec5cd62f167fffea194ed494fb94cf2930a7400a050daff1c37426f
-
Filesize
144KB
MD5513066a38057079e232f5f99baef2b94
SHA1a6da9e87415b8918447ec361ba98703d12b4ee76
SHA25602dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e
SHA51283a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5
-
Filesize
96KB
MD5329354f10504d225384e19c8c1c575db
SHA19ef0b6256f3c5bbeb444cb00ee4b278847e8aa66
SHA25624735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844
SHA512876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e
-
Filesize
325KB
MD5cf6ce6b13673dd11f0cd4b597ac56edb
SHA12017888be6edbea723b9b888ac548db5115df09e
SHA2567bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74
SHA512e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc
-
Filesize
36KB
MD59fd456fab1e052e5aaf75f4025dcd4e6
SHA19dc25826bd94382c5a518424bf244c3c4c371c8e
SHA256d7e01a137cea72824c3011801b618339e8b427d7167751421d6e4d42694ddbed
SHA512694f003f2bef468d21323a569207949dc0854f094e4e355b851d36b0f7fe6a784c0570a91e127395e406cdd498eb65b58596ecc2b6dc1541aff43ba15ff42a56
-
Filesize
234KB
MD58e3f59b8c9dfc933fca30edefeb76186
SHA137a78089d5936d1bc3b60915971604c611a94dbd
SHA256528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8
SHA5123224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d
-
Filesize
1.6MB
MD5ff622a8812d8b1eff8f8d1a32087f9d2
SHA1910615c9374b8734794ac885707ff5370db42ef1
SHA2561b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf
SHA5121a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931
-
Filesize
556KB
MD5b2eee3dee31f50e082e9c720a6d7757d
SHA13322840fef43c92fb55dc31e682d19970daf159d
SHA2564608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01
SHA5128b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3
-
Filesize
637KB
MD57538050656fe5d63cb4b80349dd1cfe3
SHA1f825c40fee87cc9952a61c8c34e9f6eee8da742d
SHA256e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099
SHA512843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8
-
Filesize
3.7MB
MD55403905cc450827ebc1dffbab6646868
SHA1b390e54b65ebab232674b3e36e3b4e4546d9ec86
SHA256c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14
SHA512c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5
-
Filesize
4.3MB
MD5d3d63d00dc13104c9b166927743fce84
SHA1c046224949b1678b61f59c74039dcfea9563469a
SHA2566f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372
SHA5127700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db
-
Filesize
403KB
MD56f6bfe02e84a595a56b456f72debd4ee
SHA190bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2
SHA2565e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51
SHA512ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50
-
Filesize
685KB
MD5c638bca1a67911af7f9ed67e7b501154
SHA10fd74d2f1bd78f678b897a776d8bce36742c39b7
SHA256519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8
SHA512ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f
-
Filesize
264B
MD5057298bd82e0fcf979b13675a1cbd74f
SHA16d12fa07e4817b2dde6cdad36dcdbaffea029efa
SHA2563ed1bdd1c43c0feed362f6a4e341b420cdd569444cc74bcd4bfead8023d699bc
SHA5120b620bee46fbe5bba27176fd6146b3c2d674781b8be12749264f1eb26901501f874bdfc4fcb1051e84619804db0aaa37e44851837e088eeee74754449bb385ae
-
Filesize
1018B
MD52b0a454065ed4019d87763c3c328fb65
SHA1c64fe64c440520c506ebe69651bafdf308cbd0de
SHA25660fc9560bd13776a6dca740f7b369ed3c8810d2587080acbcd905cbc9c40b9ff
SHA5122cadc8615f6741975703e6d40df2d748b93cbed3c0e1180569c5facc2fa1b064fb7c4d83ab4dde52b876767a6f34235f5311ad4d437decab8b89b66d65361d59
-
Filesize
6.2MB
MD51d0e07f07fe1d6668802bee5a3691f76
SHA10e4ec921e405f4965e2c8cdc4673f8426077f883
SHA256b62ef3a9297cb404ae7e3184874b6692f0a5ca9b7453bcd4cc6dcda0e01f052c
SHA512c995b7d44b7f9cfc1d4094d2604048905d62256cfbc6b9dbadfb4bad67fd8a8acbaafce4ea02f0706799b1d1068182020107cc6d16575f2914aebe9d86eedf00
-
Filesize
1KB
MD515203455c0d4cb605ca1f3df0d9ec405
SHA123512b6690ba738cdf5818e993e2f8810760541a
SHA2563f548a677474d8aff784bf1d226d856565722bfcb13a2649d99f4ccb5657a1f8
SHA5128c8a29df8492180b5912a64fc4f85c97806e57917d6f1709f6fa933911e5aae7c08570e0ce59283cfda3e6fd5d5f7600080c1f36bec42b9ca654eb69370fd28b
-
Filesize
1KB
MD5fb03ea99c80884fc0bfdb084ad6d9b15
SHA1f4e9b6cc70de0ae5095973b16fdcd192ef792e9b
SHA2565756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b
SHA5120d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db
-
Filesize
558B
MD546a14ace46da23926110ffb2affeafa4
SHA1350e7ef5b033594976db78cfa88379fd58d11cc8
SHA2568f8ba645b50bcde4dbceadfc71f42d33b4119005616fe129fdae1006a442cf84
SHA512a7219c6cdd61ed1286e081fd7ef15d0b9865f28fe3ea9234bfa61d1b2b5ecf202e1b1d980e2d120770bc067d7a233fb3b6db58f0844b5a2ff9fa58ebc279f80e
-
Filesize
1KB
MD56177d1d6c3c98c6a693b37860f30ea6b
SHA182c5f128489a1a194aaa6db641a2e8cf4e560f5b
SHA2560903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76
SHA512fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e
-
Filesize
1KB
MD53fd80952c58026455d728c657ffc9f25
SHA149718183600880fb25a5db9f4437f12bd245a19c
SHA2565a2725d5165ef358972352829805c74a7bada16dc898f8d9162c53f8b7555227
SHA512f4d3da87e9b1a33fdedaebc15f27c26f01549168279867f04087d3bc9ac68b35a1c2c2903cb709c65919ebab11e37ce58505e6c462b2ccfdc24918b79d06f2d8
-
Filesize
1KB
MD5a326927fc5c5b40517642a5c1e1fcc08
SHA17c44080ecf01293443a95a93aad965aa59698369
SHA2563e7982c5eb7c0ce065f4b66c622a73e5d687ec34ba5633fabf593cdc563bd293
SHA5128abff473f2fc2180bec253c0deddc65f8dc3a97f7a0c91890ea4b372a14198f4ae66cec7201ad35fa79a4953a9ac6447a92d33c01dd61ad4a8e7f784ee085e27
-
Filesize
165KB
MD5b9be841281819a5af07e3611913a55f5
SHA1d300645112844d2263dac11fcd8298487a5c04e0
SHA2562887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9
SHA5127393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0
-
C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe
Filesize56KB
MD5fcc1dd4e146e391ef903a92fa76c9744
SHA123a4b7e248063314b103d61651806af1b2b021d7
SHA2560e135bfc916702467ce03d43ae9309ff1469d7497bc89c3782057eb9ea867b67
SHA51299f70ff03760fb481851c1278bc0306367c616cbc74d7cb44e81e1215e9f667066e02d60d63af7faf102093afb831eb0d937016487e59ee586a8212e676f6d9a