Overview

overview

10

Static

static

1

bb6fd94d08...be.exe

windows7-x64

10

bb6fd94d08...be.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    181s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2022 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be.exe

  • Size

    5.2MB

  • MD5

    8934b92a1d075aae29e2ab5ea5189c49

  • SHA1

    8129c3d444561ec6864d7583131f443d6fdf69cc

  • SHA256

    bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

  • SHA512

    5523c60979b88938910d46c871ba2103f8f46d06a1017d01bb34a83fd46b105fc7a9f5c9a8879d0be54215bec943d71579dc57ba2a0c879b13e1b772a44c9c95

  • SSDEEP

    98304:/+pmqu8JVd/7u7kxm+YcTjlKOxbqZcZkHOus1DgAtZRixAHAILz1IimEMh:+g7kKcToOYIku1DtbbgIHDmEMh

Score
10/10
collectiondiscoveryevasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Executes dropped EXE 56 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 22 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 11 IoCs
    collection
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of UnmapMainImage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:484
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:872
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:696
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:964
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:1000
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1160
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1096
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:2576
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    PID:1080
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS -p
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:912
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:800
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of UnmapMainImage
      PID:3416
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of UnmapMainImage
      PID:3344
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      2⤵
        PID:3500
      • C:\Windows\system32\SppExtComObj.exe
        C:\Windows\system32\SppExtComObj.exe -Embedding
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        PID:3968
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of UnmapMainImage
        PID:4668
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of UnmapMainImage
        PID:3716
      • C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
        2⤵
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        PID:4832
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
        2⤵
          PID:3556
        • C:\Windows\System32\mousocoreworker.exe
          C:\Windows\System32\mousocoreworker.exe -Embedding
          2⤵
          • Loads dropped DLL
          • Enumerates connected drives
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of FindShellTrayWindow
          PID:5224
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1352
        • C:\Windows\system32\sihost.exe
          sihost.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          PID:2416
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1372
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
        1⤵
        • Executes dropped EXE
        PID:1360
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1380
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        PID:1276
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
        1⤵
        • Executes dropped EXE
        PID:1428
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1540
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        PID:1196
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
        1⤵
        • Executes dropped EXE
        PID:1628
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1608
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
        1⤵
        • Executes dropped EXE
        PID:1668
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1772
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1800
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
        1⤵
        • Executes dropped EXE
        PID:1904
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1916
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1960
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:1980
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Modifies data under HKEY_USERS
        PID:2080
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
        1⤵
        • Executes dropped EXE
        PID:2192
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
        1⤵
        • Executes dropped EXE
        PID:2088
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
        1⤵
        • Loads dropped DLL
        • Enumerates connected drives
        • Modifies data under HKEY_USERS
        PID:3288
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:812
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -s W32Time
        1⤵
        • Executes dropped EXE
        PID:3240
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
        1⤵
        • Executes dropped EXE
        PID:4320
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:3748
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:4744
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:3824
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2976
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2152
        • C:\Users\Admin\AppData\Local\Temp\bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be.exe
          "C:\Users\Admin\AppData\Local\Temp\bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be.exe"
          2⤵
          • UAC bypass
          • Windows security bypass
          • Checks computer location settings
          • Loads dropped DLL
          • Windows security modification
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Modifies WinLogon
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2144
          • C:\Program Files (x86)\RF_L\RF.exe
            "C:\Program Files (x86)\RF_L\RF.exe"
            3⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3152
            • C:\Program Files\RF_L\rf.exe
              "C:\Program Files\RF_L\rf.exe"
              4⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Accesses Microsoft Outlook profiles
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • outlook_office_path
              • outlook_win_path
              PID:1116
              • C:\Program Files (x86)\RF_L\tc_IO32.exe
                "C:\Program Files (x86)\RF_L\tc_IO32.exe"
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of SetWindowsHookEx
                PID:4224
              • C:\Windows\System32\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files\RF_L\TC_Menu.dll"
                5⤵
                • Loads dropped DLL
                PID:3512
              • C:\Windows\System32\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\RF_L\tc_OL.dll"
                5⤵
                • Registers COM server for autorun
                • Loads dropped DLL
                • Modifies registry class
                PID:3668
              • C:\Windows\System32\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\RF_L\tc_OL.dll"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3592
                • C:\Windows\SysWOW64\regsvr32.exe
                  /s "C:\Program Files (x86)\RF_L\tc_OL.dll"
                  6⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:4624
              • C:\Program Files\RF_L\tc_Sign.exe
                "C:\Program Files\RF_L\tc_Sign.exe"
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies system certificate store
                • Suspicious use of SetWindowsHookEx
                PID:4376
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
        1⤵
        • Executes dropped EXE
        PID:2696
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
        1⤵
        • Executes dropped EXE
        PID:2688
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2676
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
        1⤵
        • Executes dropped EXE
        PID:2656
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
        1⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of UnmapMainImage
        PID:2560
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2444
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2368
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:2360
      • C:\Windows\System32\WaaSMedicAgent.exe
        C:\Windows\System32\WaaSMedicAgent.exe 1cf74e58b4ba7abe27f618e3633fa18b L6FyWyY5xUObfykrmPzkGQ.0.1.0.0.0
        1⤵
        • Sets service image path in registry
        PID:3588
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          2⤵
          • Loads dropped DLL
          • Enumerates connected drives
          • Suspicious use of FindShellTrayWindow
          PID:2864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
        1⤵
        • Loads dropped DLL
        • Enumerates connected drives
        PID:2228
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
        1⤵
        • Loads dropped DLL
        • Checks processor information in registry
        PID:2952

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\RF_L\Log\TCLOG_2022_10.Txt
        Filesize

        345B

        MD5

        6249840934449ddb11db8a1978ba3cef

        SHA1

        2522b7680cb078531abc4f981154df374adf2363

        SHA256

        b02f570c2c16d793d492407da48ccec3695bc97d80ab45964af8b04dde624d7d

        SHA512

        7b2660631786aad19a5ad122864eaf22f6e301c26e16c6ef944f898feaf3e4716f94c56a8b20f29f4fea707dcb87e80a0b809daa07e8df4cb6a688bedb30fb97

        Download Submit

      • C:\Program Files (x86)\RF_L\MFC90KOR.dll
        Filesize

        45KB

        MD5

        5017f29e77552c1a34cd4d835362cdd7

        SHA1

        eba31791876f3b7dbaa08606aa1f72944c10fb04

        SHA256

        3baec8e203787cca2c7e6d106d92859be6496e03ad70318167ff729472814b3d

        SHA512

        7e5b34776d46da900b4266ec3ba30f736352cd2c1b80ab7e4e126a6d41aa1507973ef2134c24cf36b2ef6af9bbe756318aa0dd8eac00f4dedde152e32714cb25

        Download Submit

      • C:\Program Files (x86)\RF_L\Microsoft.VC90.CRT.manifest
        Filesize

        524B

        MD5

        6bb5d2aad0ae1b4a82e7ddf7cf58802a

        SHA1

        70f7482f5f5c89ce09e26d745c532a9415cd5313

        SHA256

        9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582

        SHA512

        3ea373dacfd3816405f6268ac05886a7dc8709752c6d955ef881b482176f0671bcdc900906fc1ebdc22e9d349f6d5a8423d19e9e7c0e6f9f16b334c68137df2b

        Download Submit

      • C:\Program Files (x86)\RF_L\Microsoft.VC90.MFC.manifest
        Filesize

        548B

        MD5

        ce3ab3bd3ff80fce88dcb0ea3d48a0c9

        SHA1

        c6ba2c252c6d102911015d0211f6cab48095931c

        SHA256

        f7205c5c0a629d0cc60e30e288e339f08616be67b55757d4a403a2b54e23922b

        SHA512

        211e247ea82458fd68bcc91a6731e9e3630a9d5901f4be4af6099ad15a90caf2826e14846951fdd7d3b199994fd3ac97ca9e325cf0dfeb9474aea9b0d6339dd3

        Download Submit

      • C:\Program Files (x86)\RF_L\Microsoft.VC90.MFCLOC.manifest
        Filesize

        5KB

        MD5

        6439b46d6d9cb337ddf2d8e643455951

        SHA1

        ad2d3c5e60da82f66cf0561c22741ebbe3dec39e

        SHA256

        81e13dc44e21fca2b095e82c34294c199d37428f32de36d5ffa6cd3b54f88d7b

        SHA512

        2dfd9080bc705d98c017824fc0e42eb9840f478529536d152876e48d700003301b78326c24c173a040864bf51b42b657aaf80a318d1cc82aec05374d04894c73

        Download Submit

      • C:\Program Files (x86)\RF_L\RF.exe
        Filesize

        1.5MB

        MD5

        82545d3d8474a181fa0cec82da0dc87f

        SHA1

        17bb9b969cd259f8132efce932b350146e8843b1

        SHA256

        3d4776638ac7c3265b3a7b3abfa9a75ac76366363a42ecbbcaaaa33ceb9ad832

        SHA512

        222278fbadd514268f75b5cd74cd9fc7dbeaeccc6983547980f26905f8c9c071355e54cd7681f9c04348895c1800346fa91f42174980e9da26cce9e6e7113d88

        Download Submit

      • C:\Program Files (x86)\RF_L\RF.exe
        Filesize

        1.5MB

        MD5

        82545d3d8474a181fa0cec82da0dc87f

        SHA1

        17bb9b969cd259f8132efce932b350146e8843b1

        SHA256

        3d4776638ac7c3265b3a7b3abfa9a75ac76366363a42ecbbcaaaa33ceb9ad832

        SHA512

        222278fbadd514268f75b5cd74cd9fc7dbeaeccc6983547980f26905f8c9c071355e54cd7681f9c04348895c1800346fa91f42174980e9da26cce9e6e7113d88

        Download Submit

      • C:\Program Files (x86)\RF_L\TCCr.dll
        Filesize

        30KB

        MD5

        04fe5db0a900d3e0c5412002abd7cde4

        SHA1

        4f61515a02f12d7137033fbdd08dd94b7359be6d

        SHA256

        224de325b57ffd400ed759919243267352aa0aafdcf260bf85c18c1472dd5e7f

        SHA512

        2432362e51fcaf1396fd1fe34cdb4d660c3b8e6cb5cbf1e4296cff578bb33747abf5e710717ca51afbd510e0816f106f868f64b53ba5e02152cb732b6846b751

        Download Submit

      • C:\Program Files (x86)\RF_L\TCCr.dll
        Filesize

        30KB

        MD5

        04fe5db0a900d3e0c5412002abd7cde4

        SHA1

        4f61515a02f12d7137033fbdd08dd94b7359be6d

        SHA256

        224de325b57ffd400ed759919243267352aa0aafdcf260bf85c18c1472dd5e7f

        SHA512

        2432362e51fcaf1396fd1fe34cdb4d660c3b8e6cb5cbf1e4296cff578bb33747abf5e710717ca51afbd510e0816f106f868f64b53ba5e02152cb732b6846b751

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_AD.DLL
        Filesize

        592KB

        MD5

        a5de26e7da1b1366ab4ef634be7328e5

        SHA1

        11acf2451be23c1f9f6a3f48867e989937320200

        SHA256

        634a8e877509e4b183030a14e6adddfbb15ba520cb014a9d1043eb975447fc09

        SHA512

        612a5fee81f5f0d6b2c8f35fe250b4dea1c5021010f003d47374aea23a47ead10aaf71a2d8f3e8b2a5c5c45c63a2ea5530284b6cd496a0cdd11f5877d71b306a

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_AU.exe
        Filesize

        393KB

        MD5

        2a7925c67a320257d77e3b8ced3ecbbb

        SHA1

        411a6e8969713f18091fbbf8ff5f5af1ee165370

        SHA256

        b423f8dc017300f4a546cd06318429acf4c5522371282468e498a676fa19fe9c

        SHA512

        341e492ec271f8a075f9857ae8cfa3424c2bd19650c4d3d88c1f85c3390de27b2957bf48aad9d1f59626c39787ea31bd9e7d83c9e1b3a94fadd26a7df380b5ec

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_EZH32.dll
        Filesize

        262KB

        MD5

        746b3aa1b566e2d22bf8d6460d9fe26d

        SHA1

        d5f113a420bc3ae495c8c7f247f2b13ab6ae4f40

        SHA256

        959d8e5e869aaed121190c6394834379c7afe5cce5a55ca87bbc36d9b119f8f4

        SHA512

        504ab71b0d523183781e333707501020dc247784bde3ac9ba55a51e763e9594198c515e98115a027648e6a5960890db2acfb334be59ade9ae5112b4f62ced694

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_IO32.exe
        Filesize

        37KB

        MD5

        018efbe5feb1c65e1f67cc90a20d9bc1

        SHA1

        c294cbd5ac0d6851885d97aacb1aae87eac2df88

        SHA256

        52e3b843049c3b28874d15ed57933f32bcac29f9448ac54333e1013a59849122

        SHA512

        be2d5a96cae26cff298f63e136ca68330d22fd40dba77236a8280661e2200ea27777001ac00aff0cc76d3b12580d3c3c1ab58f4cb74dcc22b1f5b2e57481789a

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_KB32.exe
        Filesize

        28KB

        MD5

        dfc9c75ff8d506d7c62b18dba3d6fc73

        SHA1

        19614638a988408fd34c8976738d88a90fad869a

        SHA256

        c9477f5f061ee0d92d76787670345686b9a2e18daba839579715e512e3c62cda

        SHA512

        521e3bfe50ff893dde39b8b1e6852fd662eafee39f1cbad7ab0b003b6f44211c60348d99c8572a3b00a3ff2d3bcad78c27ba89b0d09f5bc59af32569b895f66a

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_MH.dll
        Filesize

        405KB

        MD5

        874ea0c8c183c14a5aca2f3ebf4be764

        SHA1

        54b59fbf9ae4a6bfd241253d2948b065eb543e97

        SHA256

        b2f7b94fdb5e0dbe8ff8d073d2fcb56d683808094ceefea6434dbcf51c043197

        SHA512

        87ab4d4ed5e5140c2646d5d13f2cee3c72cb213f854f467e7c93020ecc109c4da2de2ba8595b2d1a2a9f3cd822a47b21b14b8980b3923ccc9552d0e32610cf07

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_Menu.dll
        Filesize

        133KB

        MD5

        2bcea0262191796be49aac4fea61ba1a

        SHA1

        b0a8eb455a93425a456b492dfca3855f6fcfded1

        SHA256

        ceb8a0e3f951e1f1d210aa923149e5c2d8d96ea0e49c88688c33844d7976e368

        SHA512

        85c9125422c6865d91b53309bbc6546d62d31e3653b1a2b6292ce1c31fd2929beff185fd3e0d3e998b6abfc4e133fd01a3442547bf8940846c4a9362f90bf36a

        Download Submit

      • C:\Program Files (x86)\RF_L\TC_OL.dll
        Filesize

        144KB

        MD5

        b60a926fb337791f6e76ad9f0f9370dd

        SHA1

        af16982ba4319983a69c82ed8e9fa9804f19808d

        SHA256

        17a217bc55cc242aa98e9de560c9bca6e3727d21bb6c450d8a5684e0daaca59b

        SHA512

        44468710497cfcda1b458b91564a15a04c9a92967e9e315e70494b924e184726444b51cc8c36f87a2fedf1171c5a3c8cf66f40d35205909afafb7f7fd7c38b0f

        Download Submit

      • C:\Program Files (x86)\RF_L\TCxEZH32.dll
        Filesize

        168KB

        MD5

        413f3d5c25cf779caa7e4e3a75dd823a

        SHA1

        eb2e9232751a25c61d05a8445f68be9b1051b1a6

        SHA256

        4976631fa4ca4efbbba606f94843364789eb365a92c41b84552d8ba364b0d07f

        SHA512

        0f3c1ae3e1f3ed16d62ad30fe7fc047f48584dd3651feb28884e53f7bb463903588e7cefca8e4dc2247d0874e87839d6b3dc397122550d44a539e9fdf1787c9d

        Download Submit

      • C:\Program Files (x86)\RF_L\mfc90.dll
        Filesize

        1.1MB

        MD5

        462ddcc5eb88f34aed991416f8e354b2

        SHA1

        6f4dbb36a8e7e594e12a2a9ed4b71af0faa762c1

        SHA256

        287bd98054c5d2c4126298ee50a2633edc745bc76a1ce04e980f3ecc577ce943

        SHA512

        35d21e545ce6436f5e70851e0665193bb1c696f61161145c92025a090d09e08f28272cbf1e271ff62ff31862544025290e22b15a7acde1aea655560300efe1ec

        Download Submit

      • C:\Program Files (x86)\RF_L\mfcm90.dll
        Filesize

        58KB

        MD5

        d4e7c1546cf3131b7d84b39f8da9e321

        SHA1

        6b096858723c76848b85d63b4da334299beced5b

        SHA256

        c4243ba85c2d130b4dec972cd291916e973d9d60fac5ceea63a01837ecc481c2

        SHA512

        4383e2bc34b078819777da73f1bd4a88b367132e653a7226ed73f43e4387ed32e8c2bcafd8679ef5e415f0b63422db05165a9e794f055aa8024fe3e7cabc66b9

        Download Submit

      • C:\Program Files (x86)\RF_L\msvcm90.dll
        Filesize

        219KB

        MD5

        4a8bc195abdc93f0db5dab7f5093c52f

        SHA1

        b55a206fc91ecc3adeda65d286522aa69f04ac88

        SHA256

        b371af3ce6cb5d0b411919a188d5274df74d5ee49f6dd7b1ccb5a31466121a18

        SHA512

        197c12825efa2747afd10fafe3e198c1156ed20d75bad07984caa83447d0c7d498ef67cee11004232ca5d4dbbb9ae9d43bfd073002d3d0d8385476876ef48a94

        Download Submit

      • C:\Program Files (x86)\RF_L\msvcp90.dll
        Filesize

        555KB

        MD5

        6de5c66e434a9c1729575763d891c6c2

        SHA1

        a230e64e0a5830544a25890f70ce9c9296245945

        SHA256

        4f7ed27b532888ce72b96e52952073eab2354160d1156924489054b7fa9b0b1a

        SHA512

        27ec83ee49b752a31a9469e17104ed039d74919a103b625a9250ac2d4d8b8601034d8b3e2fa87aadbafbdb89b01c1152943e8f9a470293cc7d62c2eefa389d2c

        Download Submit

      • C:\Program Files (x86)\RF_L\msvcr90.dll
        Filesize

        640KB

        MD5

        e7d91d008fe76423962b91c43c88e4eb

        SHA1

        29268ef0cd220ad3c5e9812befd3f5759b27a266

        SHA256

        ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185

        SHA512

        c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92

        Download Submit

      • C:\Program Files (x86)\RF_L\skin\status_green.bmp
        Filesize

        20KB

        MD5

        c76147afafd40d415d6e718db853a4e3

        SHA1

        2ab309ea8f1542e60e4cc70c6750e2c1b00779f1

        SHA256

        8ea1a0b0d6a292655570324bc78f94964acf839eaf817373befa8c519552da3b

        SHA512

        164f0dfd483c147e1919c651dbacd781eccd13b37c7cd5e2956e5a101cea11c301e788a237fe25d8355f269a80b027718467fe1b3e1507baa05d924f2c8632d9

        Download Submit

      • C:\Program Files (x86)\RF_L\skin\status_red.bmp
        Filesize

        20KB

        MD5

        c9051fa64d7b2a95161b8d537fdb7b78

        SHA1

        83d7118a0c0758a9cdc4c03aa2eff7520e36d775

        SHA256

        284d3180dc28fa6293893d7a84b255a4e80278ce1936b7fd1862192fab8366eb

        SHA512

        37eff16df472f4f7ed3e3278b1d638e5fa575124c1d290ef6ac14d41d9db6c0cf9812bf517324b821b8b741ff3dac0de209061fe33436a9cba3cf744fc27ae61

        Download Submit

      • C:\Program Files (x86)\RF_L\tc1_form.sys
        Filesize

        17KB

        MD5

        6730413d6e75b3e796fb1969673cd306

        SHA1

        9b1ca14eb456592b0a6f5287ebb3c2d8fcd314ec

        SHA256

        98d72fa405e9d227b663f49c174f983fbeb325723c06f0bf4da4cf28aec34f77

        SHA512

        ed6543ac8c70b9796fdca5ff3078875c727efb4297296c1c61bca0c579c55ad7089c5f486417bc9dc9681f97994e74f87df233bc8318cac68debd86f013dc6b0

        Download Submit

      • C:\Program Files (x86)\RF_L\tc_8SR.exe
        Filesize

        30KB

        MD5

        659e01fc421fb0a39befb98c9a2eaca2

        SHA1

        d1678e80ddc39a83930e246df416aaf59633a09a

        SHA256

        2a1b2a5e9c6745fa02ce6dc4dd11b144a589f56d5ecc14ac4182c6ba2e28ee15

        SHA512

        18e12619df3392534988db623ae05c96b6f7b60c349a46eba75ddf1e3758156b0f1fb167fefc0f950be00db9d380e907d3009b3da299a005cbb74360765f8bf8

        Download Submit

      • C:\Program Files (x86)\RF_L\tc_Default.sys
        Filesize

        168B

        MD5

        b8896bb9658c73a3ffa40f968b123dcd

        SHA1

        59c0c6a5c8145648d5a57da3baa033f5351689eb

        SHA256

        b7660bc3af49c31a3f2a02fb56de3c986ea42bbe4f4d4074820a1b4358210691

        SHA512

        6e39b67dddcf8b6ab785c21b4d5ae64be01c97ae5836aa42a48f08fe7c62b6a772e5d8610961f0e50a0576f4cbc53c55b4b906a92a9753816063b54fb943e50c

        Download Submit

      • C:\Program Files (x86)\RF_L\tc_IO32.exe
        Filesize

        37KB

        MD5

        018efbe5feb1c65e1f67cc90a20d9bc1

        SHA1

        c294cbd5ac0d6851885d97aacb1aae87eac2df88

        SHA256

        52e3b843049c3b28874d15ed57933f32bcac29f9448ac54333e1013a59849122

        SHA512

        be2d5a96cae26cff298f63e136ca68330d22fd40dba77236a8280661e2200ea27777001ac00aff0cc76d3b12580d3c3c1ab58f4cb74dcc22b1f5b2e57481789a

        Download Submit

      • C:\Program Files\RF_L\MFC90KOR.dll
        Filesize

        45KB

        MD5

        e51c4dcda00da254733430492fc9c84b

        SHA1

        9917f2ec17a64796bbb439bcc973cf1feda5030c

        SHA256

        21a75faaff69d68fd4d7e568ed9cafac7cf7dd43ecd8b46985be0a5a9ad3eb78

        SHA512

        dad4f1162b73e62e19769633c1aa9d6caf4aa1b351f747dfc3cd63c190805e7367dd2327857f854671f0edb3a3b72e07794673750fcaccd69f6f72b3c4dcf5ed

        Download Submit

      • C:\Program Files\RF_L\Microsoft.VC90.CRT.manifest
        Filesize

        526B

        MD5

        e194d0211efacefe4b45a1fff7b0ee68

        SHA1

        df29e3e3bd04779616fd3e84734d8a329e44dd20

        SHA256

        58fc4416331672c7b7a413ce071c01ddfdf91ed1c0604ce014250b38dfc78787

        SHA512

        c4310c1cab0db0e0f5aed4cbcbf1d7643d3b4be2df6a753f520f741aa73f50ced3b7681bd8c59f971f1c5ff5e240287da65c47043526402c74bbf1b167cc665e

        Download Submit

      • C:\Program Files\RF_L\Microsoft.VC90.MFC.manifest
        Filesize

        550B

        MD5

        a4f947a900e60561c05f12ecc0ac9b8e

        SHA1

        89965aacff28dadde79e09063b3421c1befff041

        SHA256

        e85ea26d156723557653b22c10adaefdfa0d9615049541a74cdb968f146a5ace

        SHA512

        38c54a752b53c60e7fe2a7c66f81757e3f047fd37339ac2b25c83b6a61320ce646c407c2ad90eb68e91702dbffd0dd3c9a39fddc2ba1df6c187a525e013b7d32

        Download Submit

      • C:\Program Files\RF_L\Microsoft.VC90.MFCLOC.manifest
        Filesize

        5KB

        MD5

        9f1ba7257ef6bf109fc880ac2991e300

        SHA1

        30cb6539db4268c163c915c7411f40cde1d85937

        SHA256

        ec161aaa9f65e00cb9b5dc4d8cb8e1dd8f4edd97b3686a7245b09bff91ba6961

        SHA512

        e220a8f7341be296a564d733173a7ab7d360732ba27abda75dc1520b94ac78523bd526605d32d8d82694a556de418bc38368a378a836062de8250a9c8a49844a

        Download Submit

      • C:\Program Files\RF_L\RF.exe
        Filesize

        2.1MB

        MD5

        de2c67787ee96b5422383a879b19b738

        SHA1

        13732a849bd2f194a9da3c22cbd4c440f1d3782a

        SHA256

        4a9cbc43a828d42f338de79cceef9fca668f3c7c3f226f020e2b83044e9888d6

        SHA512

        58d30a17e0f3b23b1625a6c26e81f038c405b159d6b7d5153b85f17267d177ac1dcd3f8aca1e6be70e7e2c37a61bbd399a6fc2c80d742ba7d0d655af321ba368

        Download Submit

      • C:\Program Files\RF_L\TCCr.dll
        Filesize

        36KB

        MD5

        8ac4cf2e05540ec8be1068a3d95a7e0d

        SHA1

        d73e534391d8a2626cbc3402bdb52a3cecc9bbfb

        SHA256

        be9a6ecd197103ab021ca7995c4c63fcb4bb976c74565987d2721b8cb2e19ab8

        SHA512

        27f0b69465bf19a8eaa5b6876b705c30b2bfd3b65acc7cb0aba1468c5945574843a3d4fa31269667cd3eaf4b0661f5f9c4c7e8d270f8e9ea0a165699cc89abc4

        Download Submit

      • C:\Program Files\RF_L\TCCr.dll
        Filesize

        36KB

        MD5

        8ac4cf2e05540ec8be1068a3d95a7e0d

        SHA1

        d73e534391d8a2626cbc3402bdb52a3cecc9bbfb

        SHA256

        be9a6ecd197103ab021ca7995c4c63fcb4bb976c74565987d2721b8cb2e19ab8

        SHA512

        27f0b69465bf19a8eaa5b6876b705c30b2bfd3b65acc7cb0aba1468c5945574843a3d4fa31269667cd3eaf4b0661f5f9c4c7e8d270f8e9ea0a165699cc89abc4

        Download Submit

      • C:\Program Files\RF_L\TC_AD.DLL
        Filesize

        713KB

        MD5

        f79e96ad602858944fa88980120af3ce

        SHA1

        9e2077e50765efe43dcf91ede392f9efe8ac8f41

        SHA256

        634c881c8070a781ea2e62bfeeca856f19b19b98ab959eae98d3b1d590de3f54

        SHA512

        f34dd501cf619b492f7237d2660b59045740b29221b8eaf3a4232d7de658a226e8ec6c37278f524be950488c8e5ad476fef06743c10c000cc4d957b1f6ce4cdf

        Download Submit

      • C:\Program Files\RF_L\TC_AU.exe
        Filesize

        611KB

        MD5

        3dfc6c1ca213a60db124901955f61e34

        SHA1

        fbeb932107eb05c7fd4213e163fc6aa422d10db3

        SHA256

        64a19a40d07598833d2c7b8a4e9d0d01bb955623da37c202b0319ac28957b1f9

        SHA512

        2816ee54d95e8b88020043b06c144ed54691604529f776312e5191e09e639254530be0b8658eece304a99fb0d58afcec6e267770101476b9929c9245706fbbbb

        Download Submit

      • C:\Program Files\RF_L\TC_EZH64.dll
        Filesize

        303KB

        MD5

        8962190eb8a69b5be9dd6071c43ed286

        SHA1

        cbcb9d18517f9553bbcb62b42239568773a30843

        SHA256

        caaa7d0b5b8be3a35158b1d0ee0d4cafb28991ef6d497ffa3757c92ab78bae19

        SHA512

        d34c465ddb5e9469f92b90f23131332e25b71bd94c929f051eb94ee09892786d564ca9e9c338a63d0daef3ebeb70f3b50c61158749bc7a77cf038f14fb3385d8

        Download Submit

      • C:\Program Files\RF_L\TC_MH.dll
        Filesize

        474KB

        MD5

        be4b28622530518a10c1bca9dfa8c56f

        SHA1

        9f40d0d113930f0831569398b77833e23710da57

        SHA256

        0214d120c399d83b8344ee43992eca27fa525d25d840a378f9cd3da38ba774f1

        SHA512

        3dc7e3da1923d78d942710b2089b3514db4bb91635d5d9ce8f059c8e8d8b4dda4ebef72431f7081d3c4b48702d4358343af0ff29cde496553e591576a4089352

        Download Submit

      • C:\Program Files\RF_L\TC_Menu.dll
        Filesize

        149KB

        MD5

        b3b052d8f0548a4514e173dee89e169a

        SHA1

        230a21f93a8abc5cb178396d0741ce43324b7263

        SHA256

        6914edcf72f07b74d270f6e94a2929f3f690c0ba94a318839f1d25e5e087210d

        SHA512

        c79ba3a10593ed1a7758800fa8a1c0f074d66b714509152540da3f83039251d754124f58e920ccbb73ab032c233c39759d599a29efc1ae9ba488e7731173bc04

        Download Submit

      • C:\Program Files\RF_L\TC_OL.dll
        Filesize

        172KB

        MD5

        06910e3f673abfa38a6e49bc858fc2ed

        SHA1

        49f07050c19ef1ab61c9cd4f84cf1e0f131f836b

        SHA256

        26f621f35d7450ebbd3a299ced07047c5608ca814b2a6386c2ec45a6f5e2c358

        SHA512

        ec3fdce407e42e0e63599d03b3775075f18a659652fe26750268706d56643c94d738ac395f469a1e3701b0c207bab3a9adda666b28d68fc83eae6ed007234a84

        Download Submit

      • C:\Program Files\RF_L\TC_Patch.exe
        Filesize

        100KB

        MD5

        5f2795b2cd063429803b497d657f2938

        SHA1

        6bb378f206fed83016acaa2e707c4594d165189e

        SHA256

        cec13ab5d8c48ff17871a9c721bb8b48ad59e3867e5248d155a2ae320434d0dd

        SHA512

        2e9cace87c588e752ded017d1661097d2e9a5d74685d55b343ed142a20acb6e53d2c75d6364108f1de16206d43c287d4b043a97bb7161ee4f4a2b11512dfd2d4

        Download Submit

      • C:\Program Files\RF_L\TC_RA.exe
        Filesize

        29KB

        MD5

        6c377c001729eab9028cfc7bb663cb4a

        SHA1

        2eeabad565f2f48c115bba720536df766ea52188

        SHA256

        c54c1056c263b9bc5b86a80a05d15101b3f6a995c0bb0d1f7d2beec301968a3d

        SHA512

        b5f491f59d427d7c754444ccced4dddc40268ea5ade5c4930c5cbcbccf1e9eae443cd039a3b983f2d1d8bd4628f5a812f0b82b0dc1f06775e929842225967871

        Download Submit

      • C:\Program Files\RF_L\TC_Sign.exe
        Filesize

        287KB

        MD5

        070fdb11b963bd4644eb8da5b68d7af2

        SHA1

        d5405737e9b69608f47b8752de77849b4550a9e8

        SHA256

        218f10bb140d90eea9ea8355b3fe59d1e902b0be960a318ef84e02315ad0ea98

        SHA512

        f56ab0385c5a700d5b932ab403ec2918e0de5a619724f26f729480232960ca543546c3f86edd43f17d08006dda654f5a78abb82cd4381b2dc826986636923788

        Download Submit

      • C:\Program Files\RF_L\TCxEZH64.dll
        Filesize

        197KB

        MD5

        c01d90988f7ee7ca3e3945da60928cf4

        SHA1

        d68c5f67f66bda6b9e397e4ceaf5e2d645af1288

        SHA256

        1227eeba133f875f9948a57a74e3fafcc178618135670d80a3ff0d4d09a40e1b

        SHA512

        ea58a872fef3ec84fbac9b55d5c7605ff3dc5a09d8f479732fbe7306d7d0a6738db02c5d422dd9837b974a4d3fcbb1573394070466c48b256a360582dae7fa9f

        Download Submit

      • C:\Program Files\RF_L\mfc90.dll
        Filesize

        1.6MB

        MD5

        60b030677185841817fa38bda0da6473

        SHA1

        ae45372b4ce19c773d627f9df829fc16702fe840

        SHA256

        2a527eef7d5cbc295e5b3ceef5c5e1c34bf9fba51335102b44d73b67f5dbbe86

        SHA512

        ce1a560e372e2e35e092a7c6f823cace40d38a96246a27e5025172d418164471b0cba0319c8e83a6ff4d693f9d9250cc9d279154acf0ae9d5f9a81cc2c4f9bf0

        Download Submit

      • C:\Program Files\RF_L\mfcm90.dll
        Filesize

        65KB

        MD5

        8278d44f988acee82073fa33332289e7

        SHA1

        cd342f09db07e884878caa5a90bbe8f3bd99abb0

        SHA256

        33174be770ead05787933900b07be4598985bf9350790c47be77a56e5300ae0c

        SHA512

        6eeb0ac1197fdf7409a20f315ff3b6dc7835f53e91d5d85cd09a6788ad99e1562fb9eac265d75de3dd0db8eb20e8c3f9ed307e85e1774bbe6756aea20cddefb6

        Download Submit

      • C:\Program Files\RF_L\msvcm90.dll
        Filesize

        239KB

        MD5

        aa6698ec95f726f6931f701047426bc3

        SHA1

        00cd963ec834cc13d94b67a4f1872716486b010a

        SHA256

        450dbcf05db9e23c4cf96707d729a61fcde8b80690f7e9a3685652eff30161a3

        SHA512

        74a2ef668c8a45be3352114332ab46a4281995602efb84505a686fde1ab7b0d653e83365ae9fbf6179d4cc358d92c37cb0a5bcdbd7442ae794a481a53f596aa1

        Download Submit

      • C:\Program Files\RF_L\msvcp90.dll
        Filesize

        831KB

        MD5

        f7cd95a47f9c2291db184c6c4ad7e120

        SHA1

        67cba6f7fe2dd19b2640a7217cd968177bf100aa

        SHA256

        10859f06f41144fa32cf5da223511f85fe349b1d76471ef65f0395dac606ef63

        SHA512

        c96e17345d5b893a56d1004227e37a6906ae6da53e7cb33679e00bb807c28f4016dd6f91a2c038fe843fea56d08a55cf54ec3ea54b3a77f6ea0a08979ab7c965

        Download Submit

      • C:\Program Files\RF_L\msvcr90.dll
        Filesize

        612KB

        MD5

        23b134891c08c7f04c1747f6bcec06ea

        SHA1

        26a77ccf0e62faa436255e47a0c3c8a818733193

        SHA256

        e11ce4b90db815359b2d76f95f623fc26924c5a254f0540224fa6feb623817e5

        SHA512

        30c89f058b3b9ddd39ed7a3e3c470c2df08940dbc3ea0cf72cf271fa76ee19d956ee503a3fa2839458fbd2a61658ff3aa7f8326e6eccae9c11ac78b4c2b84c14

        Download Submit

      • C:\Program Files\RF_L\rf.exe
        Filesize

        2.1MB

        MD5

        de2c67787ee96b5422383a879b19b738

        SHA1

        13732a849bd2f194a9da3c22cbd4c440f1d3782a

        SHA256

        4a9cbc43a828d42f338de79cceef9fca668f3c7c3f226f020e2b83044e9888d6

        SHA512

        58d30a17e0f3b23b1625a6c26e81f038c405b159d6b7d5153b85f17267d177ac1dcd3f8aca1e6be70e7e2c37a61bbd399a6fc2c80d742ba7d0d655af321ba368

        Download Submit

      • C:\Program Files\RF_L\skin\status_green.bmp
        Filesize

        20KB

        MD5

        c76147afafd40d415d6e718db853a4e3

        SHA1

        2ab309ea8f1542e60e4cc70c6750e2c1b00779f1

        SHA256

        8ea1a0b0d6a292655570324bc78f94964acf839eaf817373befa8c519552da3b

        SHA512

        164f0dfd483c147e1919c651dbacd781eccd13b37c7cd5e2956e5a101cea11c301e788a237fe25d8355f269a80b027718467fe1b3e1507baa05d924f2c8632d9

        Download Submit

      • C:\Program Files\RF_L\skin\status_red.bmp
        Filesize

        20KB

        MD5

        c9051fa64d7b2a95161b8d537fdb7b78

        SHA1

        83d7118a0c0758a9cdc4c03aa2eff7520e36d775

        SHA256

        284d3180dc28fa6293893d7a84b255a4e80278ce1936b7fd1862192fab8366eb

        SHA512

        37eff16df472f4f7ed3e3278b1d638e5fa575124c1d290ef6ac14d41d9db6c0cf9812bf517324b821b8b741ff3dac0de209061fe33436a9cba3cf744fc27ae61

        Download Submit

      • C:\Program Files\RF_L\tc1_form.sys
        Filesize

        17KB

        MD5

        6730413d6e75b3e796fb1969673cd306

        SHA1

        9b1ca14eb456592b0a6f5287ebb3c2d8fcd314ec

        SHA256

        98d72fa405e9d227b663f49c174f983fbeb325723c06f0bf4da4cf28aec34f77

        SHA512

        ed6543ac8c70b9796fdca5ff3078875c727efb4297296c1c61bca0c579c55ad7089c5f486417bc9dc9681f97994e74f87df233bc8318cac68debd86f013dc6b0

        Download Submit

      • C:\Program Files\RF_L\tc_8SR.exe
        Filesize

        31KB

        MD5

        ebeca6b8aa5fd9247ac9941d99d5430a

        SHA1

        cebbc84d77ed0a133b812a547dabaa941e15e4a6

        SHA256

        f22f2308aa0df6e1a695aeaeafbbe4862f86561c2633ad2c0190ace6cf1fdbf8

        SHA512

        f05597d18832bd52ed14f37650bc48debccef61ae17333872463ce5941dd5886550f48f8283df8b74f39338e0654b7c4624ddc34d4b96035afe570839478777e

        Download Submit

      • C:\Program Files\RF_L\tc_Default.sys
        Filesize

        168B

        MD5

        b8896bb9658c73a3ffa40f968b123dcd

        SHA1

        59c0c6a5c8145648d5a57da3baa033f5351689eb

        SHA256

        b7660bc3af49c31a3f2a02fb56de3c986ea42bbe4f4d4074820a1b4358210691

        SHA512

        6e39b67dddcf8b6ab785c21b4d5ae64be01c97ae5836aa42a48f08fe7c62b6a772e5d8610961f0e50a0576f4cbc53c55b4b906a92a9753816063b54fb943e50c

        Download Submit

      • C:\Program Files\RF_L\tc_Prih.dll
        Filesize

        127KB

        MD5

        3113c656cd43cfd9a99ff3f1fa7b05d1

        SHA1

        e9143cfdbdc7f552209a4c00e65bc1d2fab438c3

        SHA256

        fcddf410c7a44a28ed926b0b5deb8016eb56e890273ab8adfc403df3050f18fc

        SHA512

        9bab4b739840a0101be9036a158475aef0091da86eea2d3128d3603e43b96f77df750c7a81d7dc6a34acccc79d1413eac82d224eead4ef4bbf39f12e9cbbbe53

        Download Submit

      • C:\Program Files\RF_L\tc_svr.exe
        Filesize

        14KB

        MD5

        3a5c91b35b82654e1a3acfe40183e382

        SHA1

        f287faeedd777312a1b1f7a1911c635bc604ffe2

        SHA256

        7cb4017abe287f516cbbd05a8d0476d814fc58167fc08c3203f3df90d8efd118

        SHA512

        598b65db64316efc6858a9583495def1b670ea9bc28189f605df598eb2e0c491cb9cf2a3fc69b15a8ee55572e961b794de53792382320244e0e7824c6e5c0d0d

        Download Submit

      • C:\Program Files\RF_L\tc_un.exe
        Filesize

        476KB

        MD5

        5a124cf010db353d2cf2045d5f54c2b9

        SHA1

        f79be201de9f58e22f0d914eb7928c43a742e899

        SHA256

        f94b09757e03388984a6fc260a5228fa1d3a630b7beea0f95dd7fd31cf0f13ec

        SHA512

        44bbe0f2983558a5b2d0b8b37311aa1425b7b097f2427eedd4bd62e6e9540dfafccc770f16e969c9cb36a46f0ecb385e7bf409792bd1c91a5666ba5830f7c341

        Download Submit

      • C:\Program Files\RF_L\vcomp90.dll
        Filesize

        58KB

        MD5

        63e472c8410a0e9ce25c35a0482bbbbf

        SHA1

        cad23d1a666da6d6dd07f5e4bc5be2862c3d2171

        SHA256

        5c3a317908bc4091bb74c276df5d7493a5fde93bfef1df73872523ab5df601a6

        SHA512

        16d323ce7e309073ace9fd8ec2b30728c8b3c9c336a1ec9e0257d972b248607b17a1b1526687ef39c74914e5a4432f027e70c273f53873a3e7174653e5a8090b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nskE257.tmp\System.dll
        Filesize

        11KB

        MD5

        55a26d7800446f1373056064c64c3ce8

        SHA1

        80256857e9a0a9c8897923b717f3435295a76002

        SHA256

        904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

        SHA512

        04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nskE257.tmp\UserInfo.dll
        Filesize

        4KB

        MD5

        c051c86f6fa84ac87efb0cf3961950a1

        SHA1

        f18f4bb803099b80a3a013ecb03fea11cff0ac01

        SHA256

        d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166

        SHA512

        6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nskE257.tmp\UserInfo.dll
        Filesize

        4KB

        MD5

        c051c86f6fa84ac87efb0cf3961950a1

        SHA1

        f18f4bb803099b80a3a013ecb03fea11cff0ac01

        SHA256

        d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166

        SHA512

        6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2

        Download Submit

      • memory/332-205-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/696-210-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/912-213-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1116-141-0x0000000000000000-mapping.dmp

        Download

      • memory/1116-203-0x000000000B140000-0x000000000B452000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2152-255-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2416-253-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3152-135-0x0000000000000000-mapping.dmp

        Download

      • memory/3344-206-0x000001C189400000-0x000001C189712000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/3344-232-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3416-260-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3416-207-0x000001D503600000-0x000001D503912000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/3512-199-0x0000000000000000-mapping.dmp

        Download

      • memory/3592-201-0x0000000000000000-mapping.dmp

        Download

      • memory/3668-200-0x0000000000000000-mapping.dmp

        Download

      • memory/3716-261-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3716-208-0x000001D6E2490000-0x000001D6E27A2000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/3968-233-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4224-146-0x0000000000000000-mapping.dmp

        Download

      • memory/4376-204-0x0000000000000000-mapping.dmp

        Download

      • memory/4624-202-0x0000000000000000-mapping.dmp

        Download

      • memory/4668-209-0x000002AF843B0000-0x000002AF846C2000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/4668-262-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4832-225-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5224-264-0x0000000000000000-mapping.dmp

        Download

      • memory/5224-265-0x00007FFF190C0000-0x00007FFF190D0000-memory.dmp

        Filesize

        64KB

        Download