rms | 22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
Size

6.2MB
MD5

a7986c8bc73f693f300760fba89f4fb1
SHA1

b16b1f976cdf63e8eabfc81d84ce40a1cb20cfd4
SHA256

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f
SHA512

6094c187711a12ada8fd63dfecc7f86ab0d7e14b6727ee99d4bd85c4a600c8027ae5a3bf440d40d9a282b9fb24eaeac6c5d8ea49ba40328bfc045253f47d0ed1

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1systemsmss.exe22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1systemsmss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 7 IoCs

Processes:

1systemsmss.exesvnhost.exesvnhost.exesvnhost.exesvnhost.exesystemsmss.exesystemsmss.exe

pid process

1752 1systemsmss.exe
4288 svnhost.exe
1716 svnhost.exe
1264 svnhost.exe
4220 svnhost.exe
3784 systemsmss.exe
3324 systemsmss.exe

pid	process
1752	1systemsmss.exe
4288	svnhost.exe
1716	svnhost.exe
1264	svnhost.exe
4220	svnhost.exe
3784	systemsmss.exe
3324	systemsmss.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe1systemsmss.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	1systemsmss.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe1systemsmss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemsmss.exe = "C:\\Windows\\System64\\1systemsmss.exe"	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	1systemsmss.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

Drops file in Windows directory 13 IoCs

Processes:

1systemsmss.exe22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

description	ioc	process
File opened for modification	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File created	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File created	C:\Windows\System64\systemsmss.exe	1systemsmss.exe
File created	C:\Windows\Zont911\Tupe.bat	1systemsmss.exe
File created	C:\Windows\System64\vp8encoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\svnhost.exe	1systemsmss.exe
File created	C:\Windows\System64\1systemsmss.exe	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
File opened for modification	C:\Windows\System64\1systemsmss.exe	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
File created	C:\Windows\Zont911\Regedit.reg	1systemsmss.exe
File created	C:\Windows\Zont911\Home.zip	1systemsmss.exe
File created	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1systemsmss.exe
File opened for modification	C:\Windows\System64\systemsmss.exe	1systemsmss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3560 regedit.exe

pid	process
3560	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

pid	process
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exe

description	pid	process
Token: SeDebugPrivilege	4288	svnhost.exe
Token: SeDebugPrivilege	1264	svnhost.exe
Token: SeTakeOwnershipPrivilege	4220	svnhost.exe
Token: SeTcbPrivilege	4220	svnhost.exe
Token: SeTcbPrivilege	4220	svnhost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

svnhost.exesvnhost.exesvnhost.exesvnhost.exe

pid process

4288 svnhost.exe
1716 svnhost.exe
1264 svnhost.exe
4220 svnhost.exe

pid	process
4288	svnhost.exe
1716	svnhost.exe
1264	svnhost.exe
4220	svnhost.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe1systemsmss.execmd.exesvnhost.exe

description	pid	process	target process
PID 5032 wrote to memory of 1752	5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe	1systemsmss.exe
PID 5032 wrote to memory of 1752	5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe	1systemsmss.exe
PID 5032 wrote to memory of 1752	5032	22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe	1systemsmss.exe
PID 1752 wrote to memory of 3560	1752	1systemsmss.exe	regedit.exe
PID 1752 wrote to memory of 3560	1752	1systemsmss.exe	regedit.exe
PID 1752 wrote to memory of 3560	1752	1systemsmss.exe	regedit.exe
PID 1752 wrote to memory of 3000	1752	1systemsmss.exe	cmd.exe
PID 1752 wrote to memory of 3000	1752	1systemsmss.exe	cmd.exe
PID 1752 wrote to memory of 3000	1752	1systemsmss.exe	cmd.exe
PID 3000 wrote to memory of 4388	3000	cmd.exe	chcp.com
PID 3000 wrote to memory of 4388	3000	cmd.exe	chcp.com
PID 3000 wrote to memory of 4388	3000	cmd.exe	chcp.com
PID 3000 wrote to memory of 4288	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 4288	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 4288	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1716	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1716	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1716	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1264	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1264	3000	cmd.exe	svnhost.exe
PID 3000 wrote to memory of 1264	3000	cmd.exe	svnhost.exe
PID 4220 wrote to memory of 3784	4220	svnhost.exe	systemsmss.exe
PID 4220 wrote to memory of 3324	4220	svnhost.exe	systemsmss.exe
PID 4220 wrote to memory of 3784	4220	svnhost.exe	systemsmss.exe
PID 4220 wrote to memory of 3784	4220	svnhost.exe	systemsmss.exe
PID 4220 wrote to memory of 3324	4220	svnhost.exe	systemsmss.exe
PID 4220 wrote to memory of 3324	4220	svnhost.exe	systemsmss.exe

C:\Users\Admin\AppData\Local\Temp\22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe
"C:\Users\Admin\AppData\Local\Temp\22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\System64\1systemsmss.exe
"C:\Windows\System64\1systemsmss.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
3⤵
- Runs .reg file with regedit
PID:3560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\chcp.com
Chcp 1251
4⤵
PID:4388

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /silentinstall
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /firewall
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\System64\svnhost.exe
"C:\Windows\System64\svnhost.exe" /start
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1264

C:\Windows\System64\svnhost.exe
C:\Windows\System64\svnhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\System64\systemsmss.exe
C:\Windows\System64\systemsmss.exe
2⤵
- Executes dropped EXE
PID:3784

C:\Windows\System64\systemsmss.exe
C:\Windows\System64\systemsmss.exe /tray
2⤵
- Executes dropped EXE
PID:3324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1systemsmss.exe
Filesize
6.2MB

MD5
a7986c8bc73f693f300760fba89f4fb1

SHA1
b16b1f976cdf63e8eabfc81d84ce40a1cb20cfd4

SHA256
22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f

SHA512
6094c187711a12ada8fd63dfecc7f86ab0d7e14b6727ee99d4bd85c4a600c8027ae5a3bf440d40d9a282b9fb24eaeac6c5d8ea49ba40328bfc045253f47d0ed1

Download Submit
C:\Windows\System64\1systemsmss.exe
Filesize
6.2MB

MD5
a7986c8bc73f693f300760fba89f4fb1

SHA1
b16b1f976cdf63e8eabfc81d84ce40a1cb20cfd4

SHA256
22a3c781a5d915f4ab2797a4546a57882b112d397c7c52592a15cec6b561cd5f

SHA512
6094c187711a12ada8fd63dfecc7f86ab0d7e14b6727ee99d4bd85c4a600c8027ae5a3bf440d40d9a282b9fb24eaeac6c5d8ea49ba40328bfc045253f47d0ed1

Download Submit
C:\Windows\System64\svnhost.exe
Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\svnhost.exe
Filesize
6.0MB

MD5
e437e8730f2163cba2552a5a374a885a

SHA1
514497f668ae7b80a698bd8cda6de2dcf104e450

SHA256
dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

SHA512
e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

Download Submit
C:\Windows\System64\systemsmss.exe
Filesize
5.1MB

MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\systemsmss.exe
Filesize
5.1MB

MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\systemsmss.exe
Filesize
5.1MB

MD5
bd458a26931f960f13958510e88a61a8

SHA1
be9fff29f269d649688e941e97ac03e669571837

SHA256
d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

SHA512
afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

Download Submit
C:\Windows\System64\vp8decoder.dll
Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll
Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg
Filesize
11KB

MD5
4cc849c78d4e05407d239ac114e66460

SHA1
e1c41bb549bb566ab1ce74dbae49a8e614141607

SHA256
5ecc7bbd4ad29f34942eef21911dd1e19300daeaa0b12f3b5c1003120d31c7d5

SHA512
0f04c2e3c197a4eaa1329618d931e015328273f0a9fd9c6f20db2c4623c6df20d58596d188723d762c6cc6cb21e7e07268b5915f26a76e38fa2773eaeacfe22f

Download Submit
C:\Windows\Zont911\Tupe.bat
Filesize
281B

MD5
691f040de6d335962416b319dcd416dc

SHA1
db49109c0917910f7fce8b6de690a1c7e2026226

SHA256
605d0b9c2fd1972c4ee60d8eefd336be636884dcdf54a4e5f2829c46e80fdcea

SHA512
f34ba36bdeaa43a1265ec69acfa0f199f2b4d5d90b4ea890327478f4f48ec7597d660b922dd1e149de3a1ff9b48c79e4c9c53e8a482b4cb5842bc0976f93bf89

Download Submit
memory/1264-143-0x0000000000000000-mapping.dmp

Download
memory/1716-141-0x0000000000000000-mapping.dmp

Download
memory/1752-130-0x0000000000000000-mapping.dmp

Download
memory/3000-135-0x0000000000000000-mapping.dmp

Download
memory/3324-150-0x0000000000000000-mapping.dmp

Download
memory/3560-133-0x0000000000000000-mapping.dmp

Download
memory/3784-149-0x0000000000000000-mapping.dmp

Download
memory/4288-138-0x0000000000000000-mapping.dmp

Download
memory/4388-137-0x0000000000000000-mapping.dmp

Download