rms | 94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/05/2022, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
Size

4.9MB
MD5

b741d9eaaa2f68f9370b52ac5e598554
SHA1

e90bebf43fbedac0aa78fa92ca927b5a81d10983
SHA256

94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41
SHA512

8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Score

10^/10

rms evasion persistence rat trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1svnhost.exe, explorer.exe"	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1svnhost.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 8 IoCs

pid	Process
1952	1svnhost.exe
1964	rfusclient.exe
1812	rutserv.exe
1700	rutserv.exe
1128	rutserv.exe
1204	rutserv.exe
368	rfusclient.exe
1940	rfusclient.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000133e8-68.dat	upx
behavioral1/files/0x0007000000013475-70.dat	upx
behavioral1/files/0x00070000000133e8-72.dat	upx
behavioral1/files/0x00070000000133e8-74.dat	upx
behavioral1/files/0x0007000000013475-69.dat	upx
behavioral1/files/0x0007000000013475-75.dat	upx
behavioral1/files/0x0007000000013475-78.dat	upx
behavioral1/files/0x0007000000013475-81.dat	upx
behavioral1/files/0x0007000000013475-83.dat	upx
behavioral1/files/0x00070000000133e8-88.dat	upx
behavioral1/files/0x00070000000133e8-91.dat	upx
behavioral1/files/0x00070000000139ec-94.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1952	1svnhost.exe
2032	cmd.exe
1952	1svnhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	1svnhost.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System64\1svnhost.exe	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
File created	C:\Windows\Zont911\Regedit.reg	1svnhost.exe
File created	C:\Windows\Zont911\hostbb.zip	1svnhost.exe
File created	C:\Windows\System64\rfusclient.exe	1svnhost.exe
File created	C:\Windows\System64\rutserv.exe	1svnhost.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	1svnhost.exe
File created	C:\Windows\System64\Logs\rms_log_2022-05.html	rutserv.exe
File opened for modification	C:\Windows\System64\rfusclient.exe	attrib.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	attrib.exe
File created	C:\Windows\System64\1svnhost.exe	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
File created	C:\Windows\System64\vp8decoder.dll	1svnhost.exe
File created	C:\Windows\System64\vp8encoder.dll	1svnhost.exe
File created	C:\Windows\Zont911\Tupe.bat	1svnhost.exe
File opened for modification	C:\Windows\System64\svnhost.exe	cmd.exe
File opened for modification	C:\Windows\System64\svnhost.exe	attrib.exe
File opened for modification	C:\Windows\System64\Logs\rms_log_2022-05.html	rutserv.exe
File opened for modification	C:\Windows\System64\rfusclient.exe	1svnhost.exe
File opened for modification	C:\Windows\System64\rutserv.exe	1svnhost.exe
File created	C:\Windows\System64\svnhost.exe	cmd.exe
File opened for modification	C:\Windows\System64\1svnhost.exe	attrib.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1svnhost.exe
File opened for modification	C:\Windows\System64\rutserv.exe	attrib.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\System64	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
1180	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe
1952	1svnhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	rutserv.exe
Token: SeDebugPrivilege	1128	rutserv.exe
Token: SeTakeOwnershipPrivilege	1204	rutserv.exe
Token: SeTcbPrivilege	1204	rutserv.exe
Token: SeTcbPrivilege	1204	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1812	rutserv.exe
1700	rutserv.exe
1128	rutserv.exe
1204	rutserv.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1952	1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe	27
PID 1100 wrote to memory of 1952	1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe	27
PID 1100 wrote to memory of 1952	1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe	27
PID 1100 wrote to memory of 1952	1100	94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe	27
PID 1952 wrote to memory of 1180	1952	1svnhost.exe	28
PID 1952 wrote to memory of 1180	1952	1svnhost.exe	28
PID 1952 wrote to memory of 1180	1952	1svnhost.exe	28
PID 1952 wrote to memory of 1180	1952	1svnhost.exe	28
PID 1952 wrote to memory of 2032	1952	1svnhost.exe	29
PID 1952 wrote to memory of 2032	1952	1svnhost.exe	29
PID 1952 wrote to memory of 2032	1952	1svnhost.exe	29
PID 1952 wrote to memory of 2032	1952	1svnhost.exe	29
PID 2032 wrote to memory of 1988	2032	cmd.exe	31
PID 2032 wrote to memory of 1988	2032	cmd.exe	31
PID 2032 wrote to memory of 1988	2032	cmd.exe	31
PID 2032 wrote to memory of 1988	2032	cmd.exe	31
PID 2032 wrote to memory of 1812	2032	cmd.exe	33
PID 2032 wrote to memory of 1812	2032	cmd.exe	33
PID 2032 wrote to memory of 1812	2032	cmd.exe	33
PID 2032 wrote to memory of 1812	2032	cmd.exe	33
PID 1952 wrote to memory of 1964	1952	1svnhost.exe	32
PID 1952 wrote to memory of 1964	1952	1svnhost.exe	32
PID 1952 wrote to memory of 1964	1952	1svnhost.exe	32
PID 1952 wrote to memory of 1964	1952	1svnhost.exe	32
PID 2032 wrote to memory of 1700	2032	cmd.exe	34
PID 2032 wrote to memory of 1700	2032	cmd.exe	34
PID 2032 wrote to memory of 1700	2032	cmd.exe	34
PID 2032 wrote to memory of 1700	2032	cmd.exe	34
PID 2032 wrote to memory of 1128	2032	cmd.exe	35
PID 2032 wrote to memory of 1128	2032	cmd.exe	35
PID 2032 wrote to memory of 1128	2032	cmd.exe	35
PID 2032 wrote to memory of 1128	2032	cmd.exe	35
PID 1204 wrote to memory of 368	1204	rutserv.exe	37
PID 1204 wrote to memory of 368	1204	rutserv.exe	37
PID 1204 wrote to memory of 368	1204	rutserv.exe	37
PID 1204 wrote to memory of 368	1204	rutserv.exe	37
PID 1204 wrote to memory of 1940	1204	rutserv.exe	38
PID 1204 wrote to memory of 1940	1204	rutserv.exe	38
PID 1204 wrote to memory of 1940	1204	rutserv.exe	38
PID 1204 wrote to memory of 1940	1204	rutserv.exe	38
PID 2032 wrote to memory of 792	2032	cmd.exe	39
PID 2032 wrote to memory of 792	2032	cmd.exe	39
PID 2032 wrote to memory of 792	2032	cmd.exe	39
PID 2032 wrote to memory of 792	2032	cmd.exe	39
PID 2032 wrote to memory of 1412	2032	cmd.exe	40
PID 2032 wrote to memory of 1412	2032	cmd.exe	40
PID 2032 wrote to memory of 1412	2032	cmd.exe	40
PID 2032 wrote to memory of 1412	2032	cmd.exe	40

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
792	attrib.exe
1412	attrib.exe

C:\Users\Admin\AppData\Local\Temp\94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe
"C:\Users\Admin\AppData\Local\Temp\94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\System64\1svnhost.exe
  "C:\Windows\System64\1svnhost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Windows\Zont911\Tupe.bat" "
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\chcp.com
      Chcp 1251
      4⤵
      PID:1988
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1812
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /start
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\System64\*.*" +s +h
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\System64" +s +h
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1412
- - C:\Windows\System64\rfusclient.exe
    "C:\Windows\System64\rfusclient.exe"
    3⤵
    - Executes dropped EXE
    PID:1964

C:\Windows\System64\rutserv.exe
C:\Windows\System64\rutserv.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1svnhost.exe

Filesize
4.9MB

MD5
b741d9eaaa2f68f9370b52ac5e598554

SHA1
e90bebf43fbedac0aa78fa92ca927b5a81d10983

SHA256
94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

SHA512
8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Download Submit
C:\Windows\System64\1svnhost.exe

Filesize
4.9MB

MD5
b741d9eaaa2f68f9370b52ac5e598554

SHA1
e90bebf43fbedac0aa78fa92ca927b5a81d10983

SHA256
94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

SHA512
8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\svnhost.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg

Filesize
11KB

MD5
9b83b48cc40a9c3698e9288cf39dff6d

SHA1
353d7ffa56073f403b9ec39abca2efd0e06470ae

SHA256
d3702d9b275c83a07be06f09630cea5961b2b2d05d6e88ce0b941ca053133e1c

SHA512
5edc6a7f9527ccb1508029ad3fcf5520ff25a3e2758ffc801f134396bb9fe175b168c0a24d8f80a2b009fa01496842cfe3fe99499326297f56f60c146e7df3ca

Download Submit
C:\Windows\Zont911\Tupe.bat

Filesize
354B

MD5
20189660e08a7d3363762a6bd520734b

SHA1
0bfaf971f7d912ea917af60cdaf24a08dc77888b

SHA256
b50b62fd25c96185ac760cbe850c19ac08bec36f4a06313686972f20bcbb62a6

SHA512
d28de0387c8a59e4f7527dd23ff961fbe5ac388ec083671238f55bdfbf5d5ba60f6cad2a8de3166afc7f6edd9310d65e28365ca429be73e9ebadd1776ca5d06a

Download Submit
\Windows\System64\1svnhost.exe

Filesize
4.9MB

MD5
b741d9eaaa2f68f9370b52ac5e598554

SHA1
e90bebf43fbedac0aa78fa92ca927b5a81d10983

SHA256
94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

SHA512
8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Download Submit
\Windows\System64\1svnhost.exe

Filesize
4.9MB

MD5
b741d9eaaa2f68f9370b52ac5e598554

SHA1
e90bebf43fbedac0aa78fa92ca927b5a81d10983

SHA256
94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

SHA512
8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Download Submit
\Windows\System64\1svnhost.exe

Filesize
4.9MB

MD5
b741d9eaaa2f68f9370b52ac5e598554

SHA1
e90bebf43fbedac0aa78fa92ca927b5a81d10983

SHA256
94c85f4f20b93646b67768ac6ec85ed729e9de0e334a69dec4f821b95b8a1f41

SHA512
8bf8cef7e79f3b75a25031fe720a5d14f1d16cfbbf049aa16700172970a2312bfac378aa2a5f6fb376c1dfa946fff7fa3698c4a8d7f1a4fd761d0d815280004c

Download Submit
\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
memory/1100-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download