rms | 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

Analysis

max time kernel
150s
max time network
196s
platform
windows7_x64
resource
win7v20210408
submitted
13-05-2021 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
Size

6.2MB
MD5

a92bdf7da1feb431b92c3bd0e5ef990a
SHA1

957a25e2cf3c408246427ab565db52dc358cd4e7
SHA256

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6
SHA512

cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe1systemsmss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1systemsmss.exe, explorer.exe"	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1systemsmss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 7 IoCs

Processes:

1systemsmss.exesvnhost.exesvnhost.exesvnhost.exesvnhost.exesystemsmss.exesystemsmss.exe

pid process

656 1systemsmss.exe
624 svnhost.exe
1156 svnhost.exe
1744 svnhost.exe
944 svnhost.exe
864 systemsmss.exe
1864 systemsmss.exe

pid	process
656	1systemsmss.exe
624	svnhost.exe
1156	svnhost.exe
1744	svnhost.exe
944	svnhost.exe
864	systemsmss.exe
1864	systemsmss.exe

Loads dropped DLL 5 IoCs

Processes:

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe1systemsmss.execmd.exesvnhost.exe

pid	process
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
656	1systemsmss.exe
572	cmd.exe
944	svnhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe1systemsmss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	1systemsmss.exe

Drops file in Windows directory 13 IoCs

Processes:

1systemsmss.exe62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe

description	ioc	process
File created	C:\Windows\System64\systemsmss.exe	1systemsmss.exe
File created	C:\Windows\Zont911\Tupe.bat	1systemsmss.exe
File created	C:\Windows\System64\1systemsmss.exe	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
File created	C:\Windows\Zont911\Home.zip	1systemsmss.exe
File created	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File created	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File opened for modification	C:\Windows\System64\1systemsmss.exe	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
File created	C:\Windows\Zont911\Regedit.reg	1systemsmss.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File created	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File opened for modification	C:\Windows\System64\systemsmss.exe	1systemsmss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1020 regedit.exe

pid	process
1020	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe1systemsmss.exe

pid	process
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe
656	1systemsmss.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exe

description	pid	process
Token: SeDebugPrivilege	624	svnhost.exe
Token: SeDebugPrivilege	1744	svnhost.exe
Token: SeTakeOwnershipPrivilege	944	svnhost.exe
Token: SeTcbPrivilege	944	svnhost.exe
Token: SeTcbPrivilege	944	svnhost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exesvnhost.exe

pid process

624 svnhost.exe
1156 svnhost.exe
1744 svnhost.exe
944 svnhost.exe

pid	process
624	svnhost.exe
1156	svnhost.exe
1744	svnhost.exe
944	svnhost.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe1systemsmss.execmd.exesvnhost.exe

description	pid	process	target process
PID 1992 wrote to memory of 656	1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe	1systemsmss.exe
PID 1992 wrote to memory of 656	1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe	1systemsmss.exe
PID 1992 wrote to memory of 656	1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe	1systemsmss.exe
PID 1992 wrote to memory of 656	1992	62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe	1systemsmss.exe
PID 656 wrote to memory of 1020	656	1systemsmss.exe	regedit.exe
PID 656 wrote to memory of 1020	656	1systemsmss.exe	regedit.exe
PID 656 wrote to memory of 1020	656	1systemsmss.exe	regedit.exe
PID 656 wrote to memory of 1020	656	1systemsmss.exe	regedit.exe
PID 656 wrote to memory of 572	656	1systemsmss.exe	cmd.exe
PID 656 wrote to memory of 572	656	1systemsmss.exe	cmd.exe
PID 656 wrote to memory of 572	656	1systemsmss.exe	cmd.exe
PID 656 wrote to memory of 572	656	1systemsmss.exe	cmd.exe
PID 572 wrote to memory of 1900	572	cmd.exe	chcp.com
PID 572 wrote to memory of 1900	572	cmd.exe	chcp.com
PID 572 wrote to memory of 1900	572	cmd.exe	chcp.com
PID 572 wrote to memory of 1900	572	cmd.exe	chcp.com
PID 572 wrote to memory of 624	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 624	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 624	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 624	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1156	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1156	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1156	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1156	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1744	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1744	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1744	572	cmd.exe	svnhost.exe
PID 572 wrote to memory of 1744	572	cmd.exe	svnhost.exe
PID 944 wrote to memory of 864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 1864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 1864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 1864	944	svnhost.exe	systemsmss.exe
PID 944 wrote to memory of 1864	944	svnhost.exe	systemsmss.exe

C:\Users\Admin\AppData\Local\Temp\62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
"C:\Users\Admin\AppData\Local\Temp\62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\System64\1systemsmss.exe
"C:\Windows\System64\1systemsmss.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
3⤵
- Runs .reg file with regedit
PID:1020

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\Zont911\Tupe.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\chcp.com
Chcp 1251
4⤵
PID:1900

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /silentinstall
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:624

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /firewall
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /start
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\System64\svnhost.exe
C:\Windows\System64\svnhost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\System64\systemsmss.exe
C:\Windows\System64\systemsmss.exe
2⤵
- Executes dropped EXE
PID:864

C:\Windows\System64\systemsmss.exe
C:\Windows\System64\systemsmss.exe /tray
2⤵
- Executes dropped EXE
PID:1864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1systemsmss.exe
MD5
a92bdf7da1feb431b92c3bd0e5ef990a

SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7

SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Download Submit
C:\Windows\System64\1systemsmss.exe
MD5
a92bdf7da1feb431b92c3bd0e5ef990a

SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7

SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Download Submit
C:\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\systemsmss.exe
MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\systemsmss.exe
MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\systemsmss.exe
MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\vp8decoder.dll
MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll
MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg
MD5
4a00f2b3c4c978be47074e21f7f80e2f

SHA1
107da8489c771acdb71f1bdf2923e56ae87d8efb

SHA256
2283e43c1d0342d74ca33f9e1453c9776adb97d4bf81a9163fe09f5d187c6a53

SHA512
9bae7654826986d6d704d54fdeafad98cd2aa73ce4010ccaea499deb4b67ccb204a1acd0207da2a3e5064203d91f9e5efe6fe4a2e9644e98c66bf6009c65961d

Download Submit
C:\Windows\Zont911\Tupe.bat
MD5
691f040de6d335962416b319dcd416dc

SHA1
db49109c0917910f7fce8b6de690a1c7e2026226

SHA256
605d0b9c2fd1972c4ee60d8eefd336be636884dcdf54a4e5f2829c46e80fdcea

SHA512
f34ba36bdeaa43a1265ec69acfa0f199f2b4d5d90b4ea890327478f4f48ec7597d660b922dd1e149de3a1ff9b48c79e4c9c53e8a482b4cb5842bc0976f93bf89

Download Submit
\Windows\System64\1systemsmss.exe
MD5
a92bdf7da1feb431b92c3bd0e5ef990a

SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7

SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Download Submit
\Windows\System64\1systemsmss.exe
MD5
a92bdf7da1feb431b92c3bd0e5ef990a

SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7

SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Download Submit
\Windows\System64\1systemsmss.exe
MD5
a92bdf7da1feb431b92c3bd0e5ef990a

SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7

SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6

SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5

Download Submit
\Windows\System64\svnhost.exe
MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
\Windows\System64\systemsmss.exe
MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
memory/572-72-0x0000000000000000-mapping.dmp

Download
memory/624-77-0x0000000000000000-mapping.dmp

Download
memory/624-83-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/656-66-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/656-63-0x0000000000000000-mapping.dmp

Download
memory/864-96-0x0000000000000000-mapping.dmp

Download
memory/864-102-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/944-94-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1020-69-0x0000000000000000-mapping.dmp

Download
memory/1156-84-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1156-80-0x0000000000000000-mapping.dmp

Download
memory/1744-93-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1744-85-0x0000000000000000-mapping.dmp

Download
memory/1864-97-0x0000000000000000-mapping.dmp

Download
memory/1864-103-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1900-74-0x0000000000000000-mapping.dmp

Download
memory/1992-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1992-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download