rms | ae44304044f2997d2d352e7a541a6b60bf57bef170e461afd2f5782c4b999c58

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
Size

4.9MB
MD5

c44c3536b39fcaa55afeebc76915ddb6
SHA1

437888f966f5714741e86c2e5d035241a15d4a9c
SHA256

ae44304044f2997d2d352e7a541a6b60bf57bef170e461afd2f5782c4b999c58
SHA512

76ffd658586da79e76d1b5bf6f1608b065b3aead6690befd8010705ea9b69a629b28a2669c63e069756fd4740f8207355a1e9cee868e36b49cfbe3754ba878df
SSDEEP

98304:cPcea/hZ9vMwvRwCOg/XZtDpDJVWSp11YOrGpQ9OsZqjntStnOs2ac9Y5D9c:cPfaZQw5hOyNNqSpdO2HZqjnWOslSY5+

Score

10^/10

rms discovery persistence rat trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe1rfusclient.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1rfusclient.exe, explorer.exe"	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	1rfusclient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe1rfusclient.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	1rfusclient.exe

Executes dropped EXE 8 IoCs

Processes:

1rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
3644	1rfusclient.exe
4568	rutserv.exe
3232	rutserv.exe
2616	rutserv.exe
4180	rutserv.exe
2028	rfusclient.exe
956	rfusclient.exe
4428	rfusclient.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x00070000000234c0-30.dat	upx
behavioral2/files/0x00070000000234bf-28.dat	upx
behavioral2/memory/4568-32-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/4568-34-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/3232-36-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/3232-37-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/2616-39-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-47-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/2616-48-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/2028-46-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4428-52-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4428-53-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-54-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-56-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/2028-55-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-57-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-62-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-64-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-66-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-71-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-73-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-81-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/956-83-0x0000000000400000-0x00000000009B3000-memory.dmp	upx
behavioral2/memory/4180-88-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx
behavioral2/memory/4180-91-0x0000000000400000-0x0000000000ABA000-memory.dmp	upx

Drops file in Windows directory 13 IoCs

Processes:

1rfusclient.exec44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\Zont911\Regedit.reg	1rfusclient.exe
File created	C:\Windows\Zont911\hostbb.zip	1rfusclient.exe
File created	C:\Windows\System64\rfusclient.exe	1rfusclient.exe
File created	C:\Windows\Zont911\Tupe.bat	1rfusclient.exe
File opened for modification	C:\Windows\System64\vp8encoder.dll	1rfusclient.exe
File opened for modification	C:\Windows\System64\rfusclient.exe	1rfusclient.exe
File created	C:\Windows\System64\rutserv.exe	1rfusclient.exe
File created	C:\Windows\System64\vp8decoder.dll	1rfusclient.exe
File opened for modification	C:\Windows\System64\vp8decoder.dll	1rfusclient.exe
File created	C:\Windows\System64\1rfusclient.exe	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
File opened for modification	C:\Windows\System64\1rfusclient.exe	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
File opened for modification	C:\Windows\System64\rutserv.exe	1rfusclient.exe
File created	C:\Windows\System64\vp8encoder.dll	1rfusclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regedit.exechcp.comrutserv.exerutserv.exerfusclient.exec44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe1rfusclient.exerutserv.exerfusclient.exerfusclient.execmd.exerutserv.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid	Process
3352	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe

pid	Process
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid	Process
4428	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rutserv.exerutserv.exerutserv.exe

description	pid	Process
Token: SeDebugPrivilege	4568	rutserv.exe
Token: SeDebugPrivilege	2616	rutserv.exe
Token: SeTakeOwnershipPrivilege	4180	rutserv.exe
Token: SeTcbPrivilege	4180	rutserv.exe
Token: SeTcbPrivilege	4180	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid	Process
4568	rutserv.exe
3232	rutserv.exe
2616	rutserv.exe
4180	rutserv.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe1rfusclient.execmd.exerutserv.exerfusclient.exe

description	pid	Process	procid_target
PID 2888 wrote to memory of 3644	2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe	92
PID 2888 wrote to memory of 3644	2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe	92
PID 2888 wrote to memory of 3644	2888	c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe	92
PID 3644 wrote to memory of 3352	3644	1rfusclient.exe	95
PID 3644 wrote to memory of 3352	3644	1rfusclient.exe	95
PID 3644 wrote to memory of 3352	3644	1rfusclient.exe	95
PID 3644 wrote to memory of 3052	3644	1rfusclient.exe	96
PID 3644 wrote to memory of 3052	3644	1rfusclient.exe	96
PID 3644 wrote to memory of 3052	3644	1rfusclient.exe	96
PID 3052 wrote to memory of 2420	3052	cmd.exe	98
PID 3052 wrote to memory of 2420	3052	cmd.exe	98
PID 3052 wrote to memory of 2420	3052	cmd.exe	98
PID 3052 wrote to memory of 4568	3052	cmd.exe	99
PID 3052 wrote to memory of 4568	3052	cmd.exe	99
PID 3052 wrote to memory of 4568	3052	cmd.exe	99
PID 3052 wrote to memory of 3232	3052	cmd.exe	100
PID 3052 wrote to memory of 3232	3052	cmd.exe	100
PID 3052 wrote to memory of 3232	3052	cmd.exe	100
PID 3052 wrote to memory of 2616	3052	cmd.exe	101
PID 3052 wrote to memory of 2616	3052	cmd.exe	101
PID 3052 wrote to memory of 2616	3052	cmd.exe	101
PID 4180 wrote to memory of 2028	4180	rutserv.exe	103
PID 4180 wrote to memory of 2028	4180	rutserv.exe	103
PID 4180 wrote to memory of 2028	4180	rutserv.exe	103
PID 4180 wrote to memory of 956	4180	rutserv.exe	104
PID 4180 wrote to memory of 956	4180	rutserv.exe	104
PID 4180 wrote to memory of 956	4180	rutserv.exe	104
PID 2028 wrote to memory of 4428	2028	rfusclient.exe	105
PID 2028 wrote to memory of 4428	2028	rfusclient.exe	105
PID 2028 wrote to memory of 4428	2028	rfusclient.exe	105

C:\Users\Admin\AppData\Local\Temp\c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c44c3536b39fcaa55afeebc76915ddb6_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System64\1rfusclient.exe
  "C:\Windows\System64\1rfusclient.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\chcp.com
      Chcp 1251
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4568
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3232
  - - C:\Windows\System64\rutserv.exe
      "C:\Windows\System64\rutserv.exe" /start
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2616

C:\Windows\System64\rutserv.exe
C:\Windows\System64\rutserv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\System64\rfusclient.exe
    C:\Windows\System64\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:4428
- C:\Windows\System64\rfusclient.exe
  C:\Windows\System64\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System64\1rfusclient.exe

Filesize
4.9MB

MD5
c44c3536b39fcaa55afeebc76915ddb6

SHA1
437888f966f5714741e86c2e5d035241a15d4a9c

SHA256
ae44304044f2997d2d352e7a541a6b60bf57bef170e461afd2f5782c4b999c58

SHA512
76ffd658586da79e76d1b5bf6f1608b065b3aead6690befd8010705ea9b69a629b28a2669c63e069756fd4740f8207355a1e9cee868e36b49cfbe3754ba878df

Download Submit
C:\Windows\System64\rfusclient.exe

Filesize
1.5MB

MD5
eac85a4a79a168cb47c0810e23e6d2fe

SHA1
0e053ed568dc2f07d76b0e006a9e19655797b89e

SHA256
86b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f

SHA512
b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0

Download Submit
C:\Windows\System64\rutserv.exe

Filesize
1.8MB

MD5
fa4b26c53cfb2661ba072cf8da181b1a

SHA1
295f19aad28e80c5e371078989815c612110229c

SHA256
3a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7

SHA512
f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64

Download Submit
C:\Windows\System64\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Windows\System64\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Windows\Zont911\Regedit.reg

Filesize
11KB

MD5
b82fa9ef7ebc657d8e9cdc49dd7d6902

SHA1
8522e344034faa1e91dffe180137685c85b9de53

SHA256
40b70a3bf3eee7dce96b9cc2fa78a22efba9b876c5668b78bb803c029ed82b79

SHA512
3374abfbfcae6bb03848a2bd25edc2613df4ef0ebdbf888fe4a0a6222165740595e66b6bce58c6b56ec014fa627d2a8eee4a6fe6f645213df38ed4a8af549edc

Download Submit
C:\Windows\Zont911\Tupe.bat

Filesize
281B

MD5
46b491b3846fcc6b17ffbbb598fe8ab4

SHA1
6cf658c9d4320230e17462a047191a76979e2d19

SHA256
d1f1da9a663e4bcc6ceb55f5ff11c12cfd5baa1ff915d8f901118058a3aa5801

SHA512
8a3796b7894d8604ba94f70277010406fba977bce598712c57dda3558589a7bcc2afabfda0b0f90c2a9e499e098cd81f0764159ca7db0f5d9c34c82917aeaa77

Download Submit
memory/956-73-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/956-66-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/956-62-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/956-56-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/956-47-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/956-83-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/2028-55-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/2028-46-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/2616-48-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/2616-39-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/2888-9-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2888-0-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/3232-37-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/3232-36-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/3644-26-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3644-10-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/4180-71-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-57-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-64-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-54-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-81-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-88-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4180-91-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4428-53-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/4428-52-0x0000000000400000-0x00000000009B3000-memory.dmp

Filesize
5.7MB

Download
memory/4568-32-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download
memory/4568-34-0x0000000000400000-0x0000000000ABA000-memory.dmp

Filesize
6.7MB

Download