rms | 25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3

Analysis

max time kernel
116s
max time network
192s
platform
windows7_x64
resource
win7-20220331-en
submitted
27-03-2022 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe
Size

4.1MB
MD5

75cddf50910252ceef5107a43e98482b
SHA1

703d4737bd193bc81477ac13258cd86bb2211fad
SHA256

25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3
SHA512

f94b0fd1d47fb3f147670324f06f68720683c144c793944b8a8ad81ab333b9b6a0fa7adb1b27593e42f49234c4cca7dc11e21cd3b8fc1bb10013bcacb2756e0e

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 7 IoCs

pid	Process
964	data.exe
624	rutserv.exe
900	rutserv.exe
1064	rutserv.exe
976	rutserv.exe
956	rfusclient.exe
552	rfusclient.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Loads dropped DLL 7 IoCs

pid	Process
852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe
852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe
852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe
1364	cmd.exe
1364	cmd.exe
1364	cmd.exe
976	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1528	timeout.exe
1520	timeout.exe
2016	timeout.exe

Runs .reg file with regedit 1 IoCs

pid	Process
824	regedit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
624	rutserv.exe
624	rutserv.exe
624	rutserv.exe
624	rutserv.exe
900	rutserv.exe
900	rutserv.exe
1064	rutserv.exe
1064	rutserv.exe
976	rutserv.exe
976	rutserv.exe
976	rutserv.exe
976	rutserv.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	rutserv.exe
Token: SeDebugPrivilege	1064	rutserv.exe
Token: SeTakeOwnershipPrivilege	976	rutserv.exe
Token: SeTcbPrivilege	976	rutserv.exe
Token: SeTcbPrivilege	976	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
624	rutserv.exe
900	rutserv.exe
1064	rutserv.exe
976	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 852 wrote to memory of 964	852	25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe	28
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 964 wrote to memory of 1072	964	data.exe	29
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1072 wrote to memory of 1364	1072	WScript.exe	31
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 764	1364	cmd.exe	32
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 660	1364	cmd.exe	33
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1176	1364	cmd.exe	34
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 1756	1364	cmd.exe	35
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 824	1364	cmd.exe	36
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1528	1364	cmd.exe	37
PID 1364 wrote to memory of 1520	1364	cmd.exe	38

Views/modifies file attributes 1 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
676	attrib.exe
1476	attrib.exe
1176	attrib.exe
1756	attrib.exe
1744	attrib.exe

C:\Users\Admin\AppData\Local\Temp\25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe
"C:\Users\Admin\AppData\Local\Temp\25d21f44ec2dadf7600ce6627032b56723d0aa8a6df72ebe974e472cb86e52e3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Log\Windows\hiscomponent\install.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        5⤵
        
        PID:764
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f
        5⤵
        
        PID:660
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Remote Manipulator System"
        5⤵
        Views/modifies file attributes
        
        PID:1176
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Log"
        5⤵
        Views/modifies file attributes
        
        PID:1756
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "Windows\hiscomponent\regedit.reg"
        5⤵
        Runs .reg file with regedit
        
        PID:824
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1528
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:1520
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Remote Manipulator System\*.*"
        5⤵
        Views/modifies file attributes
        
        PID:1744
    - - C:\Remote Manipulator System\rutserv.exe
        
        rutserv.exe /silentinstall
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:624
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Remote Manipulator System\rutserv.exe"
        5⤵
        Views/modifies file attributes
        
        PID:676
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Remote Manipulator System\rfusclient.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1476
    - - C:\Remote Manipulator System\rutserv.exe
        
        rutserv.exe /firewall
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:900
    - - C:\Remote Manipulator System\rutserv.exe
        
        rutserv.exe /start
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:2016

C:\Remote Manipulator System\rutserv.exe
"C:\Remote Manipulator System\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:976
- C:\Remote Manipulator System\rfusclient.exe
  "C:\Remote Manipulator System\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Remote Manipulator System\rfusclient.exe
  "C:\Remote Manipulator System\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Remote Manipulator System\rfusclient.exe
    "C:\Remote Manipulator System\rfusclient.exe" /tray
    3⤵
    PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Log\Windows\hiscomponent\install.bat

Filesize
1KB

MD5
cbcb188c56d3b4c7001ee23da9cb17db

SHA1
f39f70a54e522bb875bc4019f3c1be13a68318c0

SHA256
702c49f6251d653b095793915873ff9d4767ba7f4832de0995a35c0a1a625b25

SHA512
096e6e6a0cda97450d990323e11cd9ca1bbd782c77a07a37a8fcc29d695408516ed12a57622d783f15661515f9bd00bf03ba3a2b5100d309d0b4f2fd11b398e1

Download Submit
C:\Log\Windows\hiscomponent\regedit.reg

Filesize
12KB

MD5
ac95942037420eaff0a962178500d450

SHA1
734ccb61d16499f909a3f48f90c2ca465edadef4

SHA256
0636cddcc4892f2f7759b523ae671b06d4e30beb0e21d5b929b555661fe6016f

SHA512
6dd1a3cb5a6e74e12752f3b7572ffb9a47701813ffeffde6abf1aba9063e4f179aa97d42e94c707377ba9fec1b409b7c602cd5af3fc90cc6594e72fb4a9a8079

Download Submit
C:\Log\install.vbs

Filesize
145B

MD5
bc5fa1fff095d50d252cb327ccd6661b

SHA1
8263ea4ab762f188df0f2902297cc46baf816c5c

SHA256
e8bd8b6ff5f0653e82c7239bfdb2894fbd509b45e581c2458bd84c2fd3d84886

SHA512
1eb5a0bc2b3c3ffa6f0967803239313110cd1c3293ecbb6a1f1c2d9d717a2f5aaf042dd28af8520ef63639f291e083c511527515489a45732e6191ad521f544d

Download Submit
C:\Log\rfusclient.exe

Filesize
5.1MB

MD5
caea06010be1fd215c89276a78064c79

SHA1
8f89c8d6b90b75385dacb83821f750bbc1325274

SHA256
e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479

SHA512
24a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6

Download Submit
C:\Log\rutserv.exe

Filesize
6.0MB

MD5
0a6ff2d35e08f6ab51de1e08ac1c00e9

SHA1
7cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76

SHA256
e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90

SHA512
9ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887

Download Submit
C:\Log\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Log\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Remote Manipulator System\rfusclient.exe

Filesize
2.5MB

MD5
b4acc7ccd3175f348c62aa51a0217746

SHA1
3f3f46ecd2313097687adaad8f96252f992fa1cb

SHA256
25133a0e5bc8546198f9866721672f70926b1b3e8cc8845161597ba6cd9129e7

SHA512
3a4040aeee63940b6866d66a951021bcef6017a1e02a15637cec922fbaf0fec2500292173a028d9e96c4ff8b9f5346fe92962fc015258a9ab01556e3ca1aba12

Download Submit
C:\Remote Manipulator System\rfusclient.exe

Filesize
2.6MB

MD5
2c1b24a8fdac7c7b518436f4d9902e9b

SHA1
0c0619f748a6c9b75566ced1e4cd03eaf0705a33

SHA256
2662b84c6f1de7f8270bbba8ce9c1d356866b6eb3154ab8223998219e273d544

SHA512
35dbe1e95b8a0e9189fc7b1afe892d1b2fb6a50f0fc456e56de45f02f9d23b1c9239c3747f3608d822f488977297d856145e952459c6cb104a06c960322ce5f5

Download Submit
C:\Remote Manipulator System\rfusclient.exe

Filesize
2.1MB

MD5
53d5c18e197389de7c74f6f510a52565

SHA1
c8867daba8fef8b558375b69b71f002818e7f7ac

SHA256
477d80152ea03beaac18628fca1a2efab88ec5d861d4285e1074650f772f23b9

SHA512
7e9a178a38427432b8e21eb22923d4edac444ed76ec4ce98b1062846bc72922166d24b96ac76199b2b66ae33993d661535812eeab1063d1caf78370451bbb1ad

Download Submit
C:\Remote Manipulator System\rfusclient.exe

Filesize
5.1MB

MD5
caea06010be1fd215c89276a78064c79

SHA1
8f89c8d6b90b75385dacb83821f750bbc1325274

SHA256
e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479

SHA512
24a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6

Download Submit
C:\Remote Manipulator System\rutserv.exe

Filesize
3.0MB

MD5
c896221f61805899f6ca76ae2be449fd

SHA1
471c8fa5854e0be43060c9b0063a1b99232d4c31

SHA256
d3644152dd3d23e5084c8545f8deae349bb8b225580134c97401085bea42fc96

SHA512
2128b6349fcad28b911ebe85fea2506241d59113d287b0142542992540b140566231021a453625563abe8719bbc9b9903e81d5bb3f43d85094d8d136487de459

Download Submit
C:\Remote Manipulator System\rutserv.exe

Filesize
2.6MB

MD5
220979fbbdb32e77d460ea17d50f3e80

SHA1
9c55f26d3de6d3acf0890ebacba6bf468dabd657

SHA256
37aa98f5745b063abae254185f1559cc7edb51c45af3d2a7fc9f515a169460a0

SHA512
ba44038980187353f70a2c0c84ed1e1c51b47b67599de16ae26346d7212bcb1e28f5112e93a20ef93135a7da0b574030f75cb22b9eeaeedc10a273ace6fb55b8

Download Submit
C:\Remote Manipulator System\rutserv.exe

Filesize
2.1MB

MD5
4e9656c252ec6e6397029c5fe8c64cc7

SHA1
17f85ba3adff77841c03de24a0970d5a4e195d2c

SHA256
f697471099c4eb9da87c28d9886bd05bf79a8bce0eba599bd279fe7a2b11736d

SHA512
7e3cc75dc96fab3659d463f93cd580a0b5518af796233bb74a9da6a36906c25484b7744427594051e30fce5830ae924f80c0e6d4df927b29be0deb3ac94824b0

Download Submit
C:\Remote Manipulator System\rutserv.exe

Filesize
6.0MB

MD5
0a6ff2d35e08f6ab51de1e08ac1c00e9

SHA1
7cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76

SHA256
e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90

SHA512
9ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887

Download Submit
C:\Remote Manipulator System\rutserv.exe

Filesize
6.0MB

MD5
0a6ff2d35e08f6ab51de1e08ac1c00e9

SHA1
7cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76

SHA256
e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90

SHA512
9ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887

Download Submit
C:\Remote Manipulator System\vp8decoder.dll

Filesize
378KB

MD5
d43fa82fab5337ce20ad14650085c5d9

SHA1
678aa092075ff65b6815ffc2d8fdc23af8425981

SHA256
c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

SHA512
103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

Download Submit
C:\Remote Manipulator System\vp8encoder.dll

Filesize
1.6MB

MD5
dab4646806dfca6d0e0b4d80fa9209d6

SHA1
8244dfe22ec2090eee89dad103e6b2002059d16a

SHA256
cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

SHA512
aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
4.1MB

MD5
93a8c5c8356852cc155d187ecf43b3e9

SHA1
402d8b29f0261f83d12508a8c611fbafce39a6e8

SHA256
761fd557616a4ce3f2959148fbf3ca72e5fe147f2c69867ad475d22c521243ea

SHA512
ff346c2749f706aa0c5a59a92219bb00e197c138179b3de6bc1e9d31860937f961ab14601e45477e2603ab618dec96d444de182fad2f71b522549c178440f37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
4.1MB

MD5
93a8c5c8356852cc155d187ecf43b3e9

SHA1
402d8b29f0261f83d12508a8c611fbafce39a6e8

SHA256
761fd557616a4ce3f2959148fbf3ca72e5fe147f2c69867ad475d22c521243ea

SHA512
ff346c2749f706aa0c5a59a92219bb00e197c138179b3de6bc1e9d31860937f961ab14601e45477e2603ab618dec96d444de182fad2f71b522549c178440f37f

Download Submit
\Remote Manipulator System\rfusclient.exe

Filesize
2.6MB

MD5
b11c74e8c0b1f375a812b77d4e15e50f

SHA1
9318a1aae2b9da3677f1e30309c72dd69d3c170a

SHA256
3c8a208b89adaab8f9b053cbc6c1f3afa0c9f5c5034c753ee5c2d042641cdc29

SHA512
9c68fb7dbe1c8fa38db5826d054da9a7bdd29c94c66377d5610b0285fab951444ec41cfde9d5189a12505c12c919db0fd86a6f036f7d3aed647be6fd7621b336

Download Submit
\Remote Manipulator System\rutserv.exe

Filesize
2.5MB

MD5
58b8595c51edf87d5bb46da05957831a

SHA1
c73f0ff71e1552ebd021c0516419ef551e74fe75

SHA256
83359926ee447b8d44e574ca634deb2ba05be4d1cf8a77f46556278de77672c9

SHA512
e0f45bb7f051fd359569b980ecaffbb9f10862f85b4512ca684b424319d520e6c453c1e36c000b6f4dee32a06d2a623821c7b52d26a055849404404820adf599

Download Submit
\Remote Manipulator System\rutserv.exe

Filesize
2.1MB

MD5
d57b158b0837d85a2ab3160e6942a6dd

SHA1
0817a18f4eb91bf31fdfc0a5fadea3bc264c98a1

SHA256
efd73196b652bff333a613a4a8c01dfb36f98a0ad8f7a53f5ce52b3f19dceda4

SHA512
aca6cbc2a0d35e7983efbd5bcec8325d520f832e82ea7e8f24188206ef76a87d51ceea3caa043e723adf5a32e833b24487c591bf27075eb00de42dd7bef2d7d8

Download Submit
\Remote Manipulator System\rutserv.exe

Filesize
6.0MB

MD5
0a6ff2d35e08f6ab51de1e08ac1c00e9

SHA1
7cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76

SHA256
e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90

SHA512
9ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887

Download Submit
\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
4.1MB

MD5
93a8c5c8356852cc155d187ecf43b3e9

SHA1
402d8b29f0261f83d12508a8c611fbafce39a6e8

SHA256
761fd557616a4ce3f2959148fbf3ca72e5fe147f2c69867ad475d22c521243ea

SHA512
ff346c2749f706aa0c5a59a92219bb00e197c138179b3de6bc1e9d31860937f961ab14601e45477e2603ab618dec96d444de182fad2f71b522549c178440f37f

Download Submit
\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
4.1MB

MD5
93a8c5c8356852cc155d187ecf43b3e9

SHA1
402d8b29f0261f83d12508a8c611fbafce39a6e8

SHA256
761fd557616a4ce3f2959148fbf3ca72e5fe147f2c69867ad475d22c521243ea

SHA512
ff346c2749f706aa0c5a59a92219bb00e197c138179b3de6bc1e9d31860937f961ab14601e45477e2603ab618dec96d444de182fad2f71b522549c178440f37f

Download Submit
\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

Filesize
4.1MB

MD5
93a8c5c8356852cc155d187ecf43b3e9

SHA1
402d8b29f0261f83d12508a8c611fbafce39a6e8

SHA256
761fd557616a4ce3f2959148fbf3ca72e5fe147f2c69867ad475d22c521243ea

SHA512
ff346c2749f706aa0c5a59a92219bb00e197c138179b3de6bc1e9d31860937f961ab14601e45477e2603ab618dec96d444de182fad2f71b522549c178440f37f

Download Submit
memory/852-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download