rms | 5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
Size

5.0MB
MD5

3c50bceb888b29de23acb71e9554b815
SHA1

3cf639bdd4e10621ca5c38cae10364b4ce99ecf6
SHA256

5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718
SHA512

a1977b3ce3cbe5b943001d7befc92dece3df8ecf992f3242584770654715c3a8e049fccc7ebe720574875c803a5d3a369a3ad89e7b7e5a8679a2226e6a40952a

Score

10^/10

rms persistence rat trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1svnhost.exe, explorer.exe"	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1svnhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 8 IoCs

pid	Process
4924	1svnhost.exe
4756	rutserv.exe
4928	rfusclient.exe
4664	rutserv.exe
1968	rutserv.exe
5112	rutserv.exe
400	rfusclient.exe
1232	rfusclient.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002320c-138.dat	upx
behavioral2/files/0x000600000002320d-140.dat	upx
behavioral2/files/0x000600000002320d-141.dat	upx
behavioral2/files/0x000600000002320c-143.dat	upx
behavioral2/files/0x000600000002320d-145.dat	upx
behavioral2/files/0x000600000002320d-147.dat	upx
behavioral2/files/0x000600000002320d-148.dat	upx
behavioral2/files/0x000600000002320c-153.dat	upx
behavioral2/files/0x000600000002320c-154.dat	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	1svnhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	1svnhost.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System64\1svnhost.exe	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	1svnhost.exe
File created	C:\Windows\System64\svnhost.exe	cmd.exe
File opened for modification	C:\Windows\System64\svnhost.exe	cmd.exe
File created	C:\Windows\System64\1svnhost.exe	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
File created	C:\Windows\Zont911\Regedit.reg	1svnhost.exe
File created	C:\Windows\System64\vp8decoder.dll	1svnhost.exe
File created	C:\Windows\System64\rutserv.exe	1svnhost.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1svnhost.exe
File created	C:\Windows\Zont911\Tupe.bat	1svnhost.exe
File opened for modification	C:\Windows\System64\rutserv.exe	1svnhost.exe
File created	C:\Windows\System64\vp8encoder.dll	1svnhost.exe
File created	C:\Windows\Zont911\hostor.zip	1svnhost.exe
File created	C:\Windows\System64\rfusclient.exe	1svnhost.exe
File opened for modification	C:\Windows\System64\rfusclient.exe	1svnhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
3768	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	rutserv.exe
Token: SeDebugPrivilege	1968	rutserv.exe
Token: SeTakeOwnershipPrivilege	5112	rutserv.exe
Token: SeTcbPrivilege	5112	rutserv.exe
Token: SeTcbPrivilege	5112	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4756	rutserv.exe
4664	rutserv.exe
1968	rutserv.exe
5112	rutserv.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4924	4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe	82
PID 4988 wrote to memory of 4924	4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe	82
PID 4988 wrote to memory of 4924	4988	5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe	82
PID 4924 wrote to memory of 3768	4924	1svnhost.exe	83
PID 4924 wrote to memory of 3768	4924	1svnhost.exe	83
PID 4924 wrote to memory of 3768	4924	1svnhost.exe	83
PID 4924 wrote to memory of 3896	4924	1svnhost.exe	84
PID 4924 wrote to memory of 3896	4924	1svnhost.exe	84
PID 4924 wrote to memory of 3896	4924	1svnhost.exe	84
PID 3896 wrote to memory of 2880	3896	cmd.exe	86
PID 3896 wrote to memory of 2880	3896	cmd.exe	86
PID 3896 wrote to memory of 2880	3896	cmd.exe	86
PID 3896 wrote to memory of 4756	3896	cmd.exe	87
PID 3896 wrote to memory of 4756	3896	cmd.exe	87
PID 3896 wrote to memory of 4756	3896	cmd.exe	87
PID 4924 wrote to memory of 4928	4924	1svnhost.exe	88
PID 4924 wrote to memory of 4928	4924	1svnhost.exe	88
PID 4924 wrote to memory of 4928	4924	1svnhost.exe	88
PID 3896 wrote to memory of 4664	3896	cmd.exe	89
PID 3896 wrote to memory of 4664	3896	cmd.exe	89
PID 3896 wrote to memory of 4664	3896	cmd.exe	89
PID 3896 wrote to memory of 1968	3896	cmd.exe	90
PID 3896 wrote to memory of 1968	3896	cmd.exe	90
PID 3896 wrote to memory of 1968	3896	cmd.exe	90
PID 5112 wrote to memory of 400	5112	rutserv.exe	93
PID 5112 wrote to memory of 400	5112	rutserv.exe	93
PID 5112 wrote to memory of 400	5112	rutserv.exe	93
PID 5112 wrote to memory of 1232	5112	rutserv.exe	92
PID 5112 wrote to memory of 1232	5112	rutserv.exe	92
PID 5112 wrote to memory of 1232	5112	rutserv.exe	92

C:\Users\Admin\AppData\Local\Temp\5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe
"C:\Users\Admin\AppData\Local\Temp\5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System64\1svnhost.exe
  "C:\Windows\System64\1svnhost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\SysWOW64\chcp.com
      Chcp 1251
      4⤵
      PID:2880
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4756
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4664
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /start
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1968
- - C:\Windows\System64\rfusclient.exe
    "C:\Windows\System64\rfusclient.exe"
    3⤵
    - Executes dropped EXE
    PID:4928

C:\Windows\System64\rutserv.exe
C:\Windows\System64\rutserv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe
  2⤵
  - Executes dropped EXE
  PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1svnhost.exe

Filesize
5.0MB

MD5
3c50bceb888b29de23acb71e9554b815

SHA1
3cf639bdd4e10621ca5c38cae10364b4ce99ecf6

SHA256
5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718

SHA512
a1977b3ce3cbe5b943001d7befc92dece3df8ecf992f3242584770654715c3a8e049fccc7ebe720574875c803a5d3a369a3ad89e7b7e5a8679a2226e6a40952a

Download Submit
C:\Windows\System64\1svnhost.exe

Filesize
5.0MB

MD5
3c50bceb888b29de23acb71e9554b815

SHA1
3cf639bdd4e10621ca5c38cae10364b4ce99ecf6

SHA256
5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718

SHA512
a1977b3ce3cbe5b943001d7befc92dece3df8ecf992f3242584770654715c3a8e049fccc7ebe720574875c803a5d3a369a3ad89e7b7e5a8679a2226e6a40952a

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
49de7b4f614b538be1d092fe32c6de6e

SHA1
f7dd55b5f5a91313fe232c1c2ca7ab229b4115e5

SHA256
ea38b489d3125e709cf6d022a77a7bbb09088c31616c23e05137231a3fddf679

SHA512
0129a9b92e9d53b7dc0665b4f50079bad35befa8a7e2179e37256060c44e5f1afb4f79a418ea10dc4b220c8a163d5993f298fa43467aaddb8bdaa8f4ddb1d833

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
49de7b4f614b538be1d092fe32c6de6e

SHA1
f7dd55b5f5a91313fe232c1c2ca7ab229b4115e5

SHA256
ea38b489d3125e709cf6d022a77a7bbb09088c31616c23e05137231a3fddf679

SHA512
0129a9b92e9d53b7dc0665b4f50079bad35befa8a7e2179e37256060c44e5f1afb4f79a418ea10dc4b220c8a163d5993f298fa43467aaddb8bdaa8f4ddb1d833

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
49de7b4f614b538be1d092fe32c6de6e

SHA1
f7dd55b5f5a91313fe232c1c2ca7ab229b4115e5

SHA256
ea38b489d3125e709cf6d022a77a7bbb09088c31616c23e05137231a3fddf679

SHA512
0129a9b92e9d53b7dc0665b4f50079bad35befa8a7e2179e37256060c44e5f1afb4f79a418ea10dc4b220c8a163d5993f298fa43467aaddb8bdaa8f4ddb1d833

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
49de7b4f614b538be1d092fe32c6de6e

SHA1
f7dd55b5f5a91313fe232c1c2ca7ab229b4115e5

SHA256
ea38b489d3125e709cf6d022a77a7bbb09088c31616c23e05137231a3fddf679

SHA512
0129a9b92e9d53b7dc0665b4f50079bad35befa8a7e2179e37256060c44e5f1afb4f79a418ea10dc4b220c8a163d5993f298fa43467aaddb8bdaa8f4ddb1d833

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
17354995a6a1baad7e97936dcb29742d

SHA1
69926dfe0f80c4bc48cb566d1e28dbcce2afc797

SHA256
b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067

SHA512
854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
17354995a6a1baad7e97936dcb29742d

SHA1
69926dfe0f80c4bc48cb566d1e28dbcce2afc797

SHA256
b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067

SHA512
854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
17354995a6a1baad7e97936dcb29742d

SHA1
69926dfe0f80c4bc48cb566d1e28dbcce2afc797

SHA256
b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067

SHA512
854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
17354995a6a1baad7e97936dcb29742d

SHA1
69926dfe0f80c4bc48cb566d1e28dbcce2afc797

SHA256
b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067

SHA512
854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
17354995a6a1baad7e97936dcb29742d

SHA1
69926dfe0f80c4bc48cb566d1e28dbcce2afc797

SHA256
b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067

SHA512
854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d

Download Submit
C:\Windows\System64\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg

Filesize
11KB

MD5
9eebf9cac83b328bf19f9f43647681af

SHA1
64ead13700bc3b8fa907cd8f3647e1baf8f49bb0

SHA256
375f3d89a1f53d3e0b6d605d1b274f723ba46aedd4d8bc649775b0e7e28f9723

SHA512
960d7c3a3de5ed68e3f2af89624b9b9874666b2c1328b77616752cffc039da19f99349a7a67fd54b09680c4b3ae8697bb320fecc7b82b15727281a339515033f

Download Submit
C:\Windows\Zont911\Tupe.bat

Filesize
278B

MD5
2aae081f3acb9615cd58a9a05a24bc3f

SHA1
82386fc85643d0aedfddb39a8f628ff1f51de8be

SHA256
4438fb1637120602efbe98aca834c02365b9132fe36ffd8c26d7f5c22d9ec1bd

SHA512
47a68649c4f01e9d084fa2838a7b79fd9719c4bf1dfa35d6efac92423c7423cd01fb9944610b88c73a82a2968aeb956e127308a4b5cc39fd9d8e1ede1bbff958

Download Submit