rms | ab4654147345cdc53cc0d56c8eabdd8c8e1e1a4814a7b2ad7538b1a6b5fc1396

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01fbce598696d72705032448889e75ee_JaffaCakes118.exe
Size

5.7MB
MD5

01fbce598696d72705032448889e75ee
SHA1

bddaa87ebdb5aa02479b4b183b69b0c2534dc430
SHA256

ab4654147345cdc53cc0d56c8eabdd8c8e1e1a4814a7b2ad7538b1a6b5fc1396
SHA512

fffda9c2d9050489cd40c3e68cca6b4d1ff4ce8f9ad23b0112a5f6ac670c1ff69dc7eac56abb92b7913cab107725ef5d758c4bb418b1e7cae440317fff5c5d67
SSDEEP

98304:mJY5aHvVCu1efJbF1fChlGf3aeb4bCVi1MijxLyPX96PsDKswMmfH:mJRPVuRF1KQqeb4uYMiFQX96PlMmfH

Score

10^/10

rms defense_evasion discovery evasion execution persistence privilege_escalation rat trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
3720	net1.exe
1980	net.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1352	netsh.exe
3972	netsh.exe

Sets file to hidden 1 TTPs 5 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1780	attrib.exe
1032	attrib.exe
4792	attrib.exe
3668	attrib.exe
2832	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	01fbce598696d72705032448889e75ee_JaffaCakes118.exe

Executes dropped EXE 10 IoCs

pid	Process
4992	rfusclient.exe
5028	rutserv.exe
4788	rfusclient.exe
1708	rutserv.exe
3196	rfusclient.exe
880	rutserv.exe
4868	rutserv.exe
528	rfusclient.exe
4744	rfusclient.exe
4124	rfusclient.exe

Loads dropped DLL 12 IoCs

pid	Process
1932	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
4204	MsiExec.exe
1932	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	attrib.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Manipulator System - Server	attrib.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Server\help.chm	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{11A90858-40BB-4858-A2DA-CA6495B5E907}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID69D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57cac2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57cac2.msi	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD16.tmp	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe	msiexec.exe
File created	C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC0A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57cac6.msi	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3196	sc.exe
620	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01fbce598696d72705032448889e75ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2516	PING.EXE

Kills process with taskkill 4 IoCs

evasion

pid	Process
636	taskkill.exe
4064	taskkill.exe
1584	taskkill.exe
4220	taskkill.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\PackageCode = "ED03084D7EC734C4DAE96D93DA017B5D"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Net	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "Webm.VP8Decoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A538F05F-DC08-4BF9-994F-18A86CCA6CC4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\vp8encoder.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Encoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\0\win32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder\CurVer\ = "WebM.VP8Encoder.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\ = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F4-5211-11DF-94AF-0026B977EEAA}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\InprocServer32\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server\\dsfVorbisEncoder.dll"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\Version = "83951616"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F5-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\ = "Xiph.Org Vorbis Decoder"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Remote Manipulator System - Server"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\CLSID = "{05A1D945-A794-44EF-B41A-2F851A117155}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\ProductIcon = "C:\\Windows\\Installer\\{11A90858-40BB-4858-A2DA-CA6495B5E907}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85809A11BB0485842AADAC46595B9E70	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FriendlyName = "Xiph.Org Vorbis Encoder"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000700000008000000031706933080000000000000002000000000000000000000030747933000000007000000090000000317479330000000070000000a00000007669647300001000800000aa00389b715650383000001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM VP8 Decoder Filter"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\InprocServer32	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{05A1D945-A794-44EF-B41A-2F851A117155}\FilterData = 02000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000080000000900000003174793300000000a0000000b00000003274793300000000a0000000c00000003170693308000000000000000100000000000000000000003074793300000000a0000000d0000000131789604fc26747b6c96ca05b3338fc8eeb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a0bd12f8d41586b4a8905588fec1aded90100000000001000800000aa00389b71	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\HELPDIR	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71ac66058ab342d94aaca393b906ddf98a	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85809A11BB0485842AADAC46595B9E70\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3110F3-5211-11DF-94AF-0026B977EEAA}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder.1	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebM.VP8Encoder.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Webm.VP8Decoder\CLSID\ = "{ED3110F3-5211-11DF-94AF-0026B977EEAA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\{ED3110F5-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000200002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b715650383000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}\CLSID = "{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\ = "VP8 Decoder Filter Type Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ED3110F1-5211-11DF-94AF-0026B977EEAA}\1.0\FLAGS\ = "0"	MsiExec.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2516	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1952	msiexec.exe
1952	msiexec.exe
4868	rutserv.exe
4868	rutserv.exe
4868	rutserv.exe
4868	rutserv.exe
528	rfusclient.exe
528	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4124	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeShutdownPrivilege	3272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3272	msiexec.exe
Token: SeSecurityPrivilege	1952	msiexec.exe
Token: SeCreateTokenPrivilege	3272	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3272	msiexec.exe
Token: SeLockMemoryPrivilege	3272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3272	msiexec.exe
Token: SeMachineAccountPrivilege	3272	msiexec.exe
Token: SeTcbPrivilege	3272	msiexec.exe
Token: SeSecurityPrivilege	3272	msiexec.exe
Token: SeTakeOwnershipPrivilege	3272	msiexec.exe
Token: SeLoadDriverPrivilege	3272	msiexec.exe
Token: SeSystemProfilePrivilege	3272	msiexec.exe
Token: SeSystemtimePrivilege	3272	msiexec.exe
Token: SeProfSingleProcessPrivilege	3272	msiexec.exe
Token: SeIncBasePriorityPrivilege	3272	msiexec.exe
Token: SeCreatePagefilePrivilege	3272	msiexec.exe
Token: SeCreatePermanentPrivilege	3272	msiexec.exe
Token: SeBackupPrivilege	3272	msiexec.exe
Token: SeRestorePrivilege	3272	msiexec.exe
Token: SeShutdownPrivilege	3272	msiexec.exe
Token: SeDebugPrivilege	3272	msiexec.exe
Token: SeAuditPrivilege	3272	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3272	msiexec.exe
Token: SeChangeNotifyPrivilege	3272	msiexec.exe
Token: SeRemoteShutdownPrivilege	3272	msiexec.exe
Token: SeUndockPrivilege	3272	msiexec.exe
Token: SeSyncAgentPrivilege	3272	msiexec.exe
Token: SeEnableDelegationPrivilege	3272	msiexec.exe
Token: SeManageVolumePrivilege	3272	msiexec.exe
Token: SeImpersonatePrivilege	3272	msiexec.exe
Token: SeCreateGlobalPrivilege	3272	msiexec.exe
Token: SeShutdownPrivilege	3816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3816	msiexec.exe
Token: SeCreateTokenPrivilege	3816	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3816	msiexec.exe
Token: SeLockMemoryPrivilege	3816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3816	msiexec.exe
Token: SeMachineAccountPrivilege	3816	msiexec.exe
Token: SeTcbPrivilege	3816	msiexec.exe
Token: SeSecurityPrivilege	3816	msiexec.exe
Token: SeTakeOwnershipPrivilege	3816	msiexec.exe
Token: SeLoadDriverPrivilege	3816	msiexec.exe
Token: SeSystemProfilePrivilege	3816	msiexec.exe
Token: SeSystemtimePrivilege	3816	msiexec.exe
Token: SeProfSingleProcessPrivilege	3816	msiexec.exe
Token: SeIncBasePriorityPrivilege	3816	msiexec.exe
Token: SeCreatePagefilePrivilege	3816	msiexec.exe
Token: SeCreatePermanentPrivilege	3816	msiexec.exe
Token: SeBackupPrivilege	3816	msiexec.exe
Token: SeRestorePrivilege	3816	msiexec.exe
Token: SeShutdownPrivilege	3816	msiexec.exe
Token: SeDebugPrivilege	3816	msiexec.exe
Token: SeAuditPrivilege	3816	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3816	msiexec.exe
Token: SeChangeNotifyPrivilege	3816	msiexec.exe
Token: SeRemoteShutdownPrivilege	3816	msiexec.exe
Token: SeUndockPrivilege	3816	msiexec.exe
Token: SeSyncAgentPrivilege	3816	msiexec.exe
Token: SeEnableDelegationPrivilege	3816	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2564	4504	01fbce598696d72705032448889e75ee_JaffaCakes118.exe	82
PID 4504 wrote to memory of 2564	4504	01fbce598696d72705032448889e75ee_JaffaCakes118.exe	82
PID 4504 wrote to memory of 2564	4504	01fbce598696d72705032448889e75ee_JaffaCakes118.exe	82
PID 2564 wrote to memory of 3668	2564	cmd.exe	84
PID 2564 wrote to memory of 3668	2564	cmd.exe	84
PID 2564 wrote to memory of 3668	2564	cmd.exe	84
PID 2564 wrote to memory of 2832	2564	cmd.exe	85
PID 2564 wrote to memory of 2832	2564	cmd.exe	85
PID 2564 wrote to memory of 2832	2564	cmd.exe	85
PID 2564 wrote to memory of 1780	2564	cmd.exe	86
PID 2564 wrote to memory of 1780	2564	cmd.exe	86
PID 2564 wrote to memory of 1780	2564	cmd.exe	86
PID 2564 wrote to memory of 1032	2564	cmd.exe	87
PID 2564 wrote to memory of 1032	2564	cmd.exe	87
PID 2564 wrote to memory of 1032	2564	cmd.exe	87
PID 2564 wrote to memory of 636	2564	cmd.exe	88
PID 2564 wrote to memory of 636	2564	cmd.exe	88
PID 2564 wrote to memory of 636	2564	cmd.exe	88
PID 2564 wrote to memory of 4064	2564	cmd.exe	90
PID 2564 wrote to memory of 4064	2564	cmd.exe	90
PID 2564 wrote to memory of 4064	2564	cmd.exe	90
PID 2564 wrote to memory of 1584	2564	cmd.exe	91
PID 2564 wrote to memory of 1584	2564	cmd.exe	91
PID 2564 wrote to memory of 1584	2564	cmd.exe	91
PID 2564 wrote to memory of 4220	2564	cmd.exe	92
PID 2564 wrote to memory of 4220	2564	cmd.exe	92
PID 2564 wrote to memory of 4220	2564	cmd.exe	92
PID 2564 wrote to memory of 4928	2564	cmd.exe	93
PID 2564 wrote to memory of 4928	2564	cmd.exe	93
PID 2564 wrote to memory of 4928	2564	cmd.exe	93
PID 2564 wrote to memory of 3232	2564	cmd.exe	94
PID 2564 wrote to memory of 3232	2564	cmd.exe	94
PID 2564 wrote to memory of 3232	2564	cmd.exe	94
PID 2564 wrote to memory of 1656	2564	cmd.exe	95
PID 2564 wrote to memory of 1656	2564	cmd.exe	95
PID 2564 wrote to memory of 1656	2564	cmd.exe	95
PID 1656 wrote to memory of 3696	1656	net.exe	96
PID 1656 wrote to memory of 3696	1656	net.exe	96
PID 1656 wrote to memory of 3696	1656	net.exe	96
PID 2564 wrote to memory of 3196	2564	cmd.exe	97
PID 2564 wrote to memory of 3196	2564	cmd.exe	97
PID 2564 wrote to memory of 3196	2564	cmd.exe	97
PID 2564 wrote to memory of 1352	2564	cmd.exe	98
PID 2564 wrote to memory of 1352	2564	cmd.exe	98
PID 2564 wrote to memory of 1352	2564	cmd.exe	98
PID 2564 wrote to memory of 3972	2564	cmd.exe	99
PID 2564 wrote to memory of 3972	2564	cmd.exe	99
PID 2564 wrote to memory of 3972	2564	cmd.exe	99
PID 2564 wrote to memory of 1980	2564	cmd.exe	100
PID 2564 wrote to memory of 1980	2564	cmd.exe	100
PID 2564 wrote to memory of 1980	2564	cmd.exe	100
PID 1980 wrote to memory of 3720	1980	net.exe	101
PID 1980 wrote to memory of 3720	1980	net.exe	101
PID 1980 wrote to memory of 3720	1980	net.exe	101
PID 2564 wrote to memory of 5072	2564	cmd.exe	102
PID 2564 wrote to memory of 5072	2564	cmd.exe	102
PID 2564 wrote to memory of 5072	2564	cmd.exe	102
PID 2564 wrote to memory of 4960	2564	cmd.exe	103
PID 2564 wrote to memory of 4960	2564	cmd.exe	103
PID 2564 wrote to memory of 4960	2564	cmd.exe	103
PID 2564 wrote to memory of 3272	2564	cmd.exe	104
PID 2564 wrote to memory of 3272	2564	cmd.exe	104
PID 2564 wrote to memory of 3272	2564	cmd.exe	104
PID 2564 wrote to memory of 3816	2564	cmd.exe	106

Views/modifies file attributes 1 TTPs 9 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1780	attrib.exe
840	attrib.exe
3816	attrib.exe
3668	attrib.exe
2832	attrib.exe
1032	attrib.exe
3232	attrib.exe
4792	attrib.exe
3984	attrib.exe

C:\Users\Admin\AppData\Local\Temp\01fbce598696d72705032448889e75ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01fbce598696d72705032448889e75ee_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\unstall.bat" "
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "server.msi"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3668
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "unstall.bat"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2832
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "C:\Windows\System32\de.exe"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1780
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "de.exe"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im RManServer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rmanfusclient.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rutserv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfusclient.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Program Files (x86)\Remote Manipulator System - Server"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3232
- - C:\Windows\SysWOW64\net.exe
    net stop Telnet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Telnet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3696
- - C:\Windows\SysWOW64\sc.exe
    sc config tlntsvr start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3196
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1352
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\net.exe
    net user HelpAssistant /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user HelpAssistant /delete
      4⤵
      Indicator Removal: Network Share Connection Removal
      System Location Discovery: System Language Discovery
      PID:3720
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2516
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec /I "server.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Program Files (x86)\Remote Manipulator System - Server"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11A90858-40BB-4858-A2DA-CA6495B5E907}" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\85809A11BB0485842AADAC46595B9E70\InstallProperties" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Installer\Products\85809A11BB0485842AADAC46595B9E70" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc config RManService displayname= "Windows System Service"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:620
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "de.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:840
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "server.msi"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3816
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "unstall.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3984

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 195E3CECACD456E85DDD390986B565D9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5355393678EEF0F8B2B274B83B67F007 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4204
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4992
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5028
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4788
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1708
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /server /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3196
- - C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:880

C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4868
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- - C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:4124
- C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57cac5.rbs

Filesize
14KB

MD5
c9a004704ce7a54c22ed678f2479fcbd

SHA1
8bfdc4b5357c47f2d468a203549935d09bafe1c7

SHA256
046cf427c22948410b97becaba9234db24aeb4382aaae3a4cb6897c3a2378cea

SHA512
5af97dc7735d64b8b9b58fa10bdb128b6e1854bfd896a5ec99b949d80742cee6a06d9f8c856dc489c34a13233a4b18f1605b3cec11f2aa2a41090e341f9a9bb1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\English.lg

Filesize
33KB

MD5
fb0fb6001e3efdfc29d79e045ada9798

SHA1
fb8fe198211634fa9a52866c8f607bdb6b8a4523

SHA256
7ec3ff20d8ac7514dbdbc861487cc054ba8243d95ee801cfd888ea1e47d5d0ba

SHA512
8e38b464399a6375962eaa671eaca38aed96774586d4b2818fa656e6adc1211ff6612073bec5cd62f167fffea194ed494fb94cf2930a7400a050daff1c37426f

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RIPCServer.dll

Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\RWLN.dll

Filesize
325KB

MD5
cf6ce6b13673dd11f0cd4b597ac56edb

SHA1
2017888be6edbea723b9b888ac548db5115df09e

SHA256
7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

SHA512
e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\Russian.lg

Filesize
36KB

MD5
9fd456fab1e052e5aaf75f4025dcd4e6

SHA1
9dc25826bd94382c5a518424bf244c3c4c371c8e

SHA256
d7e01a137cea72824c3011801b618339e8b427d7167751421d6e4d42694ddbed

SHA512
694f003f2bef468d21323a569207949dc0854f094e4e355b851d36b0f7fe6a784c0570a91e127395e406cdd498eb65b58596ecc2b6dc1541aff43ba15ff42a56

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rfusclient.exe

Filesize
3.7MB

MD5
5403905cc450827ebc1dffbab6646868

SHA1
b390e54b65ebab232674b3e36e3b4e4546d9ec86

SHA256
c1d493304e11ec78d720d575a97590295b0d512f79dabe37eca2f19c7ee22b14

SHA512
c826ea99a975d3a244f96dcb5eb96263454c231887e2e7eff60d30dd524f76aed2580570d00ddc6230e86efe102416e62124cc09927f0f003a5d9ea54b8b3af5

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\rutserv.exe

Filesize
4.3MB

MD5
d3d63d00dc13104c9b166927743fce84

SHA1
c046224949b1678b61f59c74039dcfea9563469a

SHA256
6f74b9fe4f650a2b046a5dfd6a50900d00168413f0f79eecfd1bde6395599372

SHA512
7700fe6269ec640c64095fd9f5db6f1812697b440df3b8009dca675009894d6ab18d2ca2a75bc52577a2f3616457aa32c6ae0e1191d60b14eab6945733f467db

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Server\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
C:\Users\Admin\AppData\Local\Temp\de.exe

Filesize
98KB

MD5
55c40916d5c6e7b85ea44f54f5b21b6b

SHA1
ee3ce7df04bac66d007e25bb78bf89ab247aff94

SHA256
c4de5ddf1da5c4bf16d1564aa337f1146c7ae121d4604ba91238894aac9964ce

SHA512
36aa11f08fe47cfa797452811203d64bb954e1762e7c3192f413dd75616776014a67f4e31d606be3465885c8eab236ca441d301e0512d1e9363e43998501953f

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.msi

Filesize
6.2MB

MD5
a3cc830dd43524733c25a93c1ebed509

SHA1
da6387176017650f5319435e20aa9047aeb95aa7

SHA256
3be12d42c14bfbca030342c07f5eab3c1a9979cf820f4554bf013b11e8a2b3a6

SHA512
3c9ba663d28f6a950ebc9059e575bb8398106ed9c4116096de15f8e53aba50ce53114f7efa077ed3f86ad77e9e6195f39dc0cac625a1a094beba46616c33bab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\unstall.bat

Filesize
2KB

MD5
316ff541208c5cba8068b6f7bf659461

SHA1
bbcd0015be244d3fc16bab49b9741b54b76472f4

SHA256
44d18aa9d02cb6cf3b42b1fb43570908871d0a218a5aee0cff306928a09b98b7

SHA512
cc5c2ca2b14f25363a55522c5adbb67943134810945c91e5c7f6b9c81b640cc4ccfc13e8504293d03ee23df90b6de6dd3647c0e68382cfbc0dcee7f79eafb3a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
1KB

MD5
136913907379112cdcc322a7758be9b8

SHA1
6b92e828d4c8bf822b5f74696e7fff99cd23a544

SHA256
aacf1b3f1e3e54800fb669d1df7884b2f6a8cf71054587a2b35afdad5184d54c

SHA512
fcb6c48a0d1a6eff94ae07079bf0ed56330644aa0df45330ff8eb4af78844b48a716efa67ccdcb560528af185991a0e722a2a1533db68c8861d48209bca64559

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
1KB

MD5
a326927fc5c5b40517642a5c1e1fcc08

SHA1
7c44080ecf01293443a95a93aad965aa59698369

SHA256
3e7982c5eb7c0ce065f4b66c622a73e5d687ec34ba5633fabf593cdc563bd293

SHA512
8abff473f2fc2180bec253c0deddc65f8dc3a97f7a0c91890ea4b372a14198f4ae66cec7201ad35fa79a4953a9ac6447a92d33c01dd61ad4a8e7f784ee085e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
1KB

MD5
fb03ea99c80884fc0bfdb084ad6d9b15

SHA1
f4e9b6cc70de0ae5095973b16fdcd192ef792e9b

SHA256
5756daf73a280857b65096ec16e93092c7501ccdfc9b3c602fd2e9ad210c911b

SHA512
0d5705f5a1b09022e2d8054c782b868635d3b7bd494400b50d980e111fe3462afd7777c0b7d8aab36652ccf7d8fd160319380f2fb3327654d2ffe9b4546352db

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
338B

MD5
c6a8f10584d19fc644c0d1d596936000

SHA1
299d7e483a003a2e7387f15793474da428a2abb0

SHA256
ebd31d2b6a29dfd4cc4127cb4b1b2c31ac91bcc8b336c060de6ad57e0ee81d8e

SHA512
f5c0ad38fdab5cb896fae3c5df321d9a262af9e1e47aa5346f749bed044d3d0fdd6a5a125a024cff9eae1de1f77061e0250a4bcc43fa56f2495eb35df8c630e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
1KB

MD5
3191b3011a4e7d1319d41945c5cc770b

SHA1
e985a16536f205b5c58a50310a3860df007ac164

SHA256
4c1938092f84eb5f35b9ca3060c3faf4eef047f852d903fcd479ded13ed56e2d

SHA512
7763b1ccfcbcd4faeb2537a161b97844aae417eac46b7ad7fe4018dd109a9c52964b1e9a8b5a8723cb5feeb0588169a49419ab77dc6de125a40b04afebce21cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~CC97.tmp

Filesize
1KB

MD5
6177d1d6c3c98c6a693b37860f30ea6b

SHA1
82c5f128489a1a194aaa6db641a2e8cf4e560f5b

SHA256
0903b4c9d92d3ff9026f61801faace5946f81713746b66ab9748829a93154c76

SHA512
fa4523f7dac49172e5c9b4db38f4e9f3d65b18410a1fddcaaffd960ff8a2ec20abe1abb31ea0a4fcd6aa2c83eda389525b71ad1ab6d7bbfa5bd1b0487008846e

Download Submit
C:\Windows\Installer\MSICC2A.tmp

Filesize
165KB

MD5
b9be841281819a5af07e3611913a55f5

SHA1
d300645112844d2263dac11fcd8298487a5c04e0

SHA256
2887c57b49ce17c0e490aa7872f2da51321e2dde26c04ab7a6afcde9eab005d9

SHA512
7393bade0f42794279660f66aad4f4bd7dae63ff29ff19be4c4c86a4c26cf7291af1514e1475e96c2169536747c08beeec8bda30eecfb5da476709c19062b2e0

Download Submit
C:\Windows\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe

Filesize
56KB

MD5
fcc1dd4e146e391ef903a92fa76c9744

SHA1
23a4b7e248063314b103d61651806af1b2b021d7

SHA256
0e135bfc916702467ce03d43ae9309ff1469d7497bc89c3782057eb9ea867b67

SHA512
99f70ff03760fb481851c1278bc0306367c616cbc74d7cb44e81e1215e9f667066e02d60d63af7faf102093afb831eb0d937016487e59ee586a8212e676f6d9a

Download Submit
memory/528-276-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/880-269-0x0000000000400000-0x00000000008D7000-memory.dmp

Filesize
4.8MB

Download
memory/1708-241-0x0000000000400000-0x00000000008D7000-memory.dmp

Filesize
4.8MB

Download
memory/3196-270-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/4124-274-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/4204-162-0x0000000002C50000-0x0000000002D0B000-memory.dmp

Filesize
748KB

Download
memory/4204-166-0x0000000002DB0000-0x0000000002F50000-memory.dmp

Filesize
1.6MB

Download
memory/4204-156-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Filesize
420KB

Download
memory/4204-151-0x0000000002B30000-0x0000000002B6D000-memory.dmp

Filesize
244KB

Download
memory/4744-277-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/4744-280-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/4788-242-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/4868-275-0x0000000000400000-0x00000000008D7000-memory.dmp

Filesize
4.8MB

Download
memory/4992-238-0x0000000000400000-0x0000000000839000-memory.dmp

Filesize
4.2MB

Download
memory/5028-237-0x0000000000400000-0x00000000008D7000-memory.dmp

Filesize
4.8MB

Download