rms | e8883266ae372bf622bf81e32e1c4f2432a3b8619c8d42e6478788e66e3df189

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe
Size

5.3MB
MD5

dd17008c9c50c7fb75c0d56312a869cd
SHA1

9ee74243ecc8652657ba4800a05132d5d86793ad
SHA256

e8883266ae372bf622bf81e32e1c4f2432a3b8619c8d42e6478788e66e3df189
SHA512

82df03c5da7ea1ce660533ac92404604eb1a71674c075361688a5d99b9addb3fba3fd1be44b0218c30946136d74dfa212a5e306f6e17cfb855752c672317ae80
SSDEEP

98304:CB3g+7KYMB8a7tCPK6w/UWaLEexs9aFczWHEYmffVplU:CBQuKYMNoK6w/uQQDFczbYm1A

Score

10^/10

rms discovery evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2788	attrib.exe

Executes dropped EXE 11 IoCs

Processes:

file.exerfusclient.exerutserv.exerfusclient.exerutserv.exerfusclient.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
2628	file.exe
1584	rfusclient.exe
2256	rutserv.exe
2460	rfusclient.exe
2936	rutserv.exe
2792	rfusclient.exe
2516	rutserv.exe
2624	rutserv.exe
2040	rfusclient.exe
532	rfusclient.exe
2092	rfusclient.exe

Loads dropped DLL 22 IoCs

Processes:

cmd.exeMsiExec.exeMsiExec.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
2800	cmd.exe
2880	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
2880	MsiExec.exe
1584	rfusclient.exe
1584	rfusclient.exe
1584	rfusclient.exe
1584	rfusclient.exe
1584	rfusclient.exe
2460	rfusclient.exe
2460	rfusclient.exe
2460	rfusclient.exe
2460	rfusclient.exe
2792	rfusclient.exe
2792	rfusclient.exe
2792	rfusclient.exe
2792	rfusclient.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x0008000000017525-17.dat	upx
behavioral1/memory/2800-19-0x00000000020C0000-0x00000000026CB000-memory.dmp	upx
behavioral1/memory/2628-21-0x0000000000400000-0x0000000000A0B000-memory.dmp	upx
behavioral1/memory/2628-290-0x0000000000400000-0x0000000000A0B000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

rutserv.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 16 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\help.chm	msiexec.exe

Drops file in Windows directory 21 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fad3.msi	msiexec.exe
File created	C:\Windows\Installer\f76fad6.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD15.tmp	msiexec.exe
File created	C:\Windows\Installer\f76fad8.msi	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\f76fad3.msi	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fad6.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI110.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

file.execmd.exerfusclient.exeattrib.exerutserv.exedd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exemsiexec.exePING.EXErutserv.exerfusclient.exemsiexec.exeMsiExec.exeMsiExec.exerfusclient.exereg.exerutserv.exerfusclient.execmd.exechcp.commsiexec.exerutserv.exerfusclient.exerfusclient.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
2548	PING.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FilterData = 02000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000080000000900000003174793300000000a0000000b00000003274793300000000a0000000c00000003170693308000000000000000100000000000000000000003074793300000000a0000000d0000000131789604fc26747b6c96ca05b3338fc8eeb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a0bd12f8d41586b4a8905588fec1aded90100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer\ = "WebM.VP8Encoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CLSID\ = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1\CLSID\ = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70\Remote_Office_Manager	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED311102-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\PackageCode = "7D5D8EF1A3925114FBB02DA03B7016A1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "Webm.VP8Decoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CurVer\ = "Webm.VP8Decoder.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ECDE.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\ProductIcon = "C:\\Windows\\Installer\\{11A90858-40BB-4858-A2DA-CA6495B5E907}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\PackageName = "men.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "WebM.VP8Encoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}\ = "Vorbis Encode Properties"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "WebM.VP8Encoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID\ = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\CLSID = "{05A1D945-A794-44EF-B41A-2F851A117155}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}"	MsiExec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2548	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

msiexec.exerutserv.exerfusclient.exe

pid	Process
2540	msiexec.exe
2540	msiexec.exe
2624	rutserv.exe
2624	rutserv.exe
2040	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeSecurityPrivilege	2540	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2632	msiexec.exe
Token: SeCreateTokenPrivilege	2632	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2632	msiexec.exe
Token: SeLockMemoryPrivilege	2632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2632	msiexec.exe
Token: SeMachineAccountPrivilege	2632	msiexec.exe
Token: SeTcbPrivilege	2632	msiexec.exe
Token: SeSecurityPrivilege	2632	msiexec.exe
Token: SeTakeOwnershipPrivilege	2632	msiexec.exe
Token: SeLoadDriverPrivilege	2632	msiexec.exe
Token: SeSystemProfilePrivilege	2632	msiexec.exe
Token: SeSystemtimePrivilege	2632	msiexec.exe
Token: SeProfSingleProcessPrivilege	2632	msiexec.exe
Token: SeIncBasePriorityPrivilege	2632	msiexec.exe
Token: SeCreatePagefilePrivilege	2632	msiexec.exe
Token: SeCreatePermanentPrivilege	2632	msiexec.exe
Token: SeBackupPrivilege	2632	msiexec.exe
Token: SeRestorePrivilege	2632	msiexec.exe
Token: SeShutdownPrivilege	2632	msiexec.exe
Token: SeDebugPrivilege	2632	msiexec.exe
Token: SeAuditPrivilege	2632	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2632	msiexec.exe
Token: SeChangeNotifyPrivilege	2632	msiexec.exe
Token: SeRemoteShutdownPrivilege	2632	msiexec.exe
Token: SeUndockPrivilege	2632	msiexec.exe
Token: SeSyncAgentPrivilege	2632	msiexec.exe
Token: SeEnableDelegationPrivilege	2632	msiexec.exe
Token: SeManageVolumePrivilege	2632	msiexec.exe
Token: SeImpersonatePrivilege	2632	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.execmd.exefile.execmd.exemsiexec.exerfusclient.exe

description	pid	Process	procid_target
PID 2460 wrote to memory of 2800	2460	dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2800	2460	dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2800	2460	dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2800	2460	dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2628	2800	cmd.exe	33
PID 2800 wrote to memory of 2628	2800	cmd.exe	33
PID 2800 wrote to memory of 2628	2800	cmd.exe	33
PID 2800 wrote to memory of 2628	2800	cmd.exe	33
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2628 wrote to memory of 2676	2628	file.exe	34
PID 2676 wrote to memory of 2792	2676	cmd.exe	36
PID 2676 wrote to memory of 2792	2676	cmd.exe	36
PID 2676 wrote to memory of 2792	2676	cmd.exe	36
PID 2676 wrote to memory of 2792	2676	cmd.exe	36
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2784	2676	cmd.exe	37
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2632	2676	cmd.exe	39
PID 2676 wrote to memory of 2548	2676	cmd.exe	40
PID 2676 wrote to memory of 2548	2676	cmd.exe	40
PID 2676 wrote to memory of 2548	2676	cmd.exe	40
PID 2676 wrote to memory of 2548	2676	cmd.exe	40
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2676 wrote to memory of 3036	2676	cmd.exe	41
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 2880	2540	msiexec.exe	42
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1432	2540	msiexec.exe	43
PID 2540 wrote to memory of 1584	2540	msiexec.exe	44
PID 2540 wrote to memory of 1584	2540	msiexec.exe	44
PID 2540 wrote to memory of 1584	2540	msiexec.exe	44
PID 2540 wrote to memory of 1584	2540	msiexec.exe	44
PID 1584 wrote to memory of 2256	1584	rfusclient.exe	45
PID 1584 wrote to memory of 2256	1584	rfusclient.exe	45

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2788	attrib.exe

C:\Users\Admin\AppData\Local\Temp\dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd17008c9c50c7fb75c0d56312a869cd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\E9E2.tmp\23.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\E9E2.tmp\file.exe
    file.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\ECDE.tmp\install.cmd" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
    - - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
    - - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2548
    - - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /I "men.msi" /qn
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h +r "C:\Program Files\Remote Manipulator System - Server"
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Installer\Products\85809A11BB0485842AADAC46595B9E70" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8B6200F9F81A464B229F55EAFA018BA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CD000DC7DDCF1B7B6A486C0CED903AA M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1432
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2256
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2460
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2936
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2792
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2516

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2624
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- - C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2092
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76fad7.rbs

Filesize
13KB

MD5
35cf68c008bbac239e1d5d712b5fc19d

SHA1
9d4919e420682137f53fadd7ef16cfb9a3674cf9

SHA256
5f9bbbf53e0fa14d5597521465af9d99d067df327e1406757cb789fd48daace5

SHA512
5a33b5d4fa60d73a4b58094fa0b46160f6e36cd3c4c32803cc6915fd591c5f52d9c74b4e773e15b5663504cc589fdc30a1532a55b4e87940c1c6bba048158826

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\English.lg

Filesize
32KB

MD5
404e37e676e429d458fd460681ba98b2

SHA1
f85e6c339457de81df9f072f2cc205fae606b5e8

SHA256
19499add88ab94748cb87b0d5cbe7a69ad6d2b10699707ddaa758a63e8244732

SHA512
68bf13cb2076e5d74814afaa9c67fc998a7172f1afa2f8c4d2c2112293871e08905fb9898672440b4b335a356895bf0bbf10ed1225011f2f77ada09c44385b78

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll

Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll

Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg

Filesize
35KB

MD5
281268d00c47bee9c7308d5f2be8e460

SHA1
cb5153ec385b5df57d1f8d583cf20ff5d4d5309f

SHA256
8a156137ea18c294d7473170e905c3fadfc3ddec8d099e1b8c63a48e58e8271d

SHA512
8561ab264552fff701e04b61caab465e49e064153a4b27c05ae8fb71b7e449f9281b5d8183b3204b57bbc2356157af446ef7d08d96f0ad30b41e93536557509f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe

Filesize
3.3MB

MD5
25f54262e5014b889caece94570d449f

SHA1
965afeff08735bc7ca7140373e6b3d0d1bd64d2e

SHA256
4834c03292e9dffe902a963633c7e417856cfd69f15d6fcec2aac6b5ba2bbdea

SHA512
df2ab04fdb8994821d4d763ddf59b0e4bef69f193dd681fd262953cb718b003b6aec28933c6bb9aa83780ad9746101141194657f58fdea16f11c560441081090

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp\23.bat

Filesize
27B

MD5
9a07c7ffbbaef06a3b6493a2f726a957

SHA1
1c0369f619bdaae3bb6beb2461c2a12aa8eba411

SHA256
bf98c2165f9e9b15bd8626648b8e588e417f4c0144c5b112bcee602c39fbd3de

SHA512
41a49efacdeff014ff1331bd57dd0a52fc6dc4ac807270a44ff5bc72eaaa70b8eb1f552dc6d3858fffb5c1a8f47034b95d5ecdd8c90f83d0a4c1c4bac86eb004

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp\install.cmd

Filesize
359B

MD5
87477a88d0b55141d0d6af5f23258817

SHA1
9d4441e51c6fa1350471ca109997256036daedc6

SHA256
c141653bddf7e903c06619c7d2442b3eae44fa70beeae15046d9941a1dbe0ad7

SHA512
0e1b357064ab1990c61667282f7303cc1eb750207587e9d2d26d1a0e0aea7560525c99abadc1fdcf223aa28f3621b88cd24dc8697d8e7babb124a3add61b71e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp\men.msi

Filesize
5.9MB

MD5
ff24c169ba65675d18f6403bcc699985

SHA1
c15b6f53eb929dc3c228dd5d5f48f4d122c0c739

SHA256
eed679c4bed5bd2c6b6bae58e4aa177229e20d34d5bbb80b30f38247dc880b45

SHA512
b8c16700d329d83347accf5a97d86f3fc2aa697010705a16ee0e1e460027e857fdc16acd4ced7a317d03414076ef6901262cc6261031a1e841e6cd2c8eeab374

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
6177d1d6c3c98c6a693b37860f30ea6b

SHA1
82c5f128489a1a194aaa6db641a2e8cf4e560f5b

SHA256
0903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76

SHA512
fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
c54e13e431501d359a7c98938a867743

SHA1
234882085bbd3ce45cd17632d914cd9c91d6968f

SHA256
a774631379492e69d9ba3348ac8dcfdc31663427a3d5525c2f0330b182d75a0d

SHA512
63a6b98a2ca7804863370ce61cdaf8c125682140d8b22e709d8d5929d5aa9192d1ab04a3fa648b604185afe40324cfb5e82bee39382bea625625566da98cb3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
1413530e795e51e7b5a0c5ca53489911

SHA1
c6c936d07249c927ec5bab0acd702b2890379eba

SHA256
1f9d959e9163930791111a67b3a18689b01b512c15e5b53dcc4c6e28d2d10fa4

SHA512
6680d4288c0e9b1d89dfc8e57839164411c92e11d8d418369c4743150e5e2ff9c8415ea28b6e2f4f642fd89c3ddb969476ea2c1ab34d5a15e947b45bef1efbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
9d53ed60dadccc45b960e7a415c2dae7

SHA1
f1b1bc2b44d5a862e4712201082cb9ab92f355fa

SHA256
8de95fa10271ca2ffc8a9d1e93d775cd34a63000e79f3012f206079a1da262b0

SHA512
b11f4fe0570f6008c38f323825c34b04be6a2a2f3208f8c9a3012ac7093df6736d2ffa99cb6a7517cbade126f5b5d1187f36f1577204e2aad89152dc38fa7755

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
136913907379112cdcc322a7758be9b8

SHA1
6b92e828d4c8bf822b5f74696e7fff99cd23a544

SHA256
aacf1b3f1e3e54800fb669d1df7884b2f6a8cf71054587a2b35afdad5184d54c

SHA512
fcb6c48a0d1a6eff94ae07079bf0ed56330644aa0df45330ff8eb4af78844b48a716efa67ccdcb560528af185991a0e722a2a1533db68c8861d48209bca64559

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
a326927fc5c5b40517642a5c1e1fcc08

SHA1
7c44080ecf01293443a95a93aad965aa59698369

SHA256
3e7982c5eb7c0ce065f4b66c622a73e5d687ec34ba5633fabf593cdc563bd293

SHA512
8abff473f2fc2180bec253c0deddc65f8dc3a97f7a0c91890ea4b372a14198f4ae66cec7201ad35fa79a4953a9ac6447a92d33c01dd61ad4a8e7f784ee085e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
fb03ea99c80884fc0bfdb084ad6d9b15

SHA1
f4e9b6cc70de0ae5095973b16fdcd192ef792e9b

SHA256
5756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b

SHA512
0d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
607B

MD5
24e6129c8822a48ddec28556a3e2df72

SHA1
5c06510570061f64bbdfccd1c7a7934319e76abd

SHA256
bc8e222cccb089c571b92449f94aea3432450ab562185f82705c1ffc2bccaae5

SHA512
4ffbd31e05f30945f61b45eb83de254ef804ca38112e815c0ab981fe6b84648e15ffd5e4dcd035f6b899891fa4662ecc19f8425a0d0fe956d161c8d163bfdbf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
876B

MD5
78af3714c5c97b96502e7612f692ff0f

SHA1
948f8565cdbea47bf9b5701ac88226a92490ff01

SHA256
f63610df3c28cedde8dcfd14785ddb53b67bd357bd510745ca57ae22b489f980

SHA512
caf2a8467456e67ecee60a8cf26424eeea6a257dcf9696287393bf187f00406da8272e5c0ca01a84c3c4a157223075d8a0db04096119670687b70e3ede983134

Download Submit
C:\Users\Admin\AppData\Local\Temp\~FD43.tmp

Filesize
1KB

MD5
3191b3011a4e7d1319d41945c5cc770b

SHA1
e985a16536f205b5c58a50310a3860df007ac164

SHA256
4c1938092f84eb5f35b9ca3060c3faf4eef047f852d903fcd479ded13ed56e2d

SHA512
7763b1ccfcbcd4faeb2537a161b97844aae417eac46b7ad7fe4018dd109a9c52964b1e9a8b5a8723cb5feeb0588169a49419ab77dc6de125a40b04afebce21cc

Download Submit
C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe

Filesize
56KB

MD5
4f3d5ebd449ca2d2b624424daf16a7ea

SHA1
b7673ae124169664ce0c091806094fff1eb2196d

SHA256
f349a4c890288560fa3f1a12f16ad16c442c7e56ad17128df7800751b2ca4d97

SHA512
2408b350ccb68cba3f30f2519817e9a8bc4bdba2c935ef4b2c82bbe72db65ddf7fe10890bc3488ca3bef11806839776140c06568833a3a09ed64e228816d0dd8

Download Submit
\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe

Filesize
3.8MB

MD5
8008e5a7f569e95bd2ebb05d347f481e

SHA1
12c02cb2d01af5aa98b8b04b31e39cee1302fc2c

SHA256
9d4d210565d9f8ce269dbe71c46e744a0ff4544069a2b73abd411122a49c60f5

SHA512
217f86d10f204443d449599cdec2804b00f35eab08c19e856606dbe4d782f1295c7b776178bcce5ca5655686df37030cef03f51414ba57103b71fb16ad0b2a82

Download Submit
\Users\Admin\AppData\Local\Temp\E9E2.tmp\file.exe

Filesize
5.3MB

MD5
949916f8f95122f95050f6568728bf87

SHA1
b9fcf36abf466e29a215d2d377a22089113e49c0

SHA256
2769ef3405e4fa1c2ae6789d91aa9276994552a6b2c651bbfce06f9373dd0fe5

SHA512
41d3e469d60d85533ea6e8242e65c31ea95ee712e166343900e2f8b38a9cfe4c86a49ed43d2429ef570698e45168c3980d14eb72b3724ee549c7f927cda019a8

Download Submit
\Windows\Installer\MSIFD15.tmp

Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
memory/532-315-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/532-327-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/532-318-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1432-175-0x0000000000930000-0x000000000096D000-memory.dmp

Filesize
244KB

Download
memory/1432-186-0x0000000002B50000-0x0000000002CF0000-memory.dmp

Filesize
1.6MB

Download
memory/1432-182-0x0000000002B50000-0x0000000002C0B000-memory.dmp

Filesize
748KB

Download
memory/1432-178-0x00000000028E0000-0x0000000002949000-memory.dmp

Filesize
420KB

Download
memory/1584-277-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2040-314-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2092-312-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2256-276-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2460-285-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2516-305-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2624-319-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2624-313-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2624-316-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2624-325-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2624-347-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2628-290-0x0000000000400000-0x0000000000A0B000-memory.dmp

Filesize
6.0MB

Download
memory/2628-21-0x0000000000400000-0x0000000000A0B000-memory.dmp

Filesize
6.0MB

Download
memory/2792-306-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2800-307-0x00000000020C0000-0x00000000026CB000-memory.dmp

Filesize
6.0MB

Download
memory/2800-19-0x00000000020C0000-0x00000000026CB000-memory.dmp

Filesize
6.0MB

Download
memory/2936-284-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download