Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-12-2021 19:49
Static task
static1
Behavioral task
behavioral1
Sample
2a6e6b54b6457078087ac12858f106b9.exe
Resource
win7-en-20211104
General
-
Target
2a6e6b54b6457078087ac12858f106b9.exe
-
Size
17.3MB
-
MD5
2a6e6b54b6457078087ac12858f106b9
-
SHA1
f573237cc96366fc92dfcdc7872ecab082b11e84
-
SHA256
93015eaddcf1cfed7c9e455cecebc51e85a5de3035282bafbfdd2b0979e46021
-
SHA512
6bb010e56bfeed60ee5262fd62b721cd3a58e8c6361f194058d5cb462e67eef1dcdcec6477c5d4afd3845c9b76e09bb998afb779fa332d2fcbb7574bcf16da4b
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 22 2784 msiexec.exe 24 2784 msiexec.exe -
Executes dropped EXE 9 IoCs
Processes:
rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exerutserv.exepid process 2568 rfusclient.exe 1924 rutserv.exe 60 rutserv.exe 1516 rutserv.exe 1584 rutserv.exe 2112 rfusclient.exe 3016 rfusclient.exe 2192 rfusclient.exe 3676 rutserv.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rfusclient.exerfusclient.exerfusclient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation rfusclient.exe -
Loads dropped DLL 11 IoCs
Processes:
MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exepid process 3052 MsiExec.exe 1924 rutserv.exe 1924 rutserv.exe 60 rutserv.exe 60 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in System32 directory 12 IoCs
Processes:
rutserv.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_BDC92AC5EF2F5AEC292F01D60DDFDA90 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_BDC92AC5EF2F5AEC292F01D60DDFDA90 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rutserv.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exerutserv.exedescription ioc process File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-12.html rutserv.exe File opened for modification C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-12.html rutserv.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\Windows8\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Danish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Polish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\Windows10\lockscr.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\Windows10\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\Windows8\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Italian.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\Windows8\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\Windows10\lockscr.cat msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\Windows8\lockscr.sys msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll msiexec.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File created C:\Windows\Installer\f75cc78.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID4E5.tmp msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{E5803A4B-5A4B-44F6-A759-882FB6AD7982} msiexec.exe File created C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\f75cc7b.msi msiexec.exe File opened for modification C:\Windows\Installer\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File opened for modification C:\Windows\Installer\f75cc78.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID8FD.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 53 IoCs
Processes:
rutserv.exemsiexec.exerutserv.exerutserv.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" rutserv.exe -
Modifies registry class 26 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductName = "Remote Utilities - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\monitor_driver msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{7C569D2B-32CF-4170-9E85-4A42382AAAB4}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\2 = "C:\\ProgramData\\Remote Utilities\\msi\\69110_{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728\RMS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\ProductIcon = "C:\\Windows\\Installer\\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{7C569D2B-32CF-4170-9E85-4A42382AAAB4}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4A3085EB4A56F447A9588F26BDA9728 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Version = "117436076" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\PackageName = "host6.10_unsigned_unsigned.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\PackageCode = "304344A91B391A04CBAA5BAD50D0367D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4A3085EB4A56F447A9588F26BDA9728\Language = "1033" msiexec.exe -
Processes:
rutserv.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rutserv.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
2a6e6b54b6457078087ac12858f106b9.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerutserv.exepid process 4068 2a6e6b54b6457078087ac12858f106b9.exe 4068 2a6e6b54b6457078087ac12858f106b9.exe 4068 2a6e6b54b6457078087ac12858f106b9.exe 4068 2a6e6b54b6457078087ac12858f106b9.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 2112 rfusclient.exe 2112 rfusclient.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 2192 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1296 msiexec.exe Token: SeIncreaseQuotaPrivilege 1296 msiexec.exe Token: SeSecurityPrivilege 2784 msiexec.exe Token: SeCreateTokenPrivilege 1296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1296 msiexec.exe Token: SeLockMemoryPrivilege 1296 msiexec.exe Token: SeIncreaseQuotaPrivilege 1296 msiexec.exe Token: SeMachineAccountPrivilege 1296 msiexec.exe Token: SeTcbPrivilege 1296 msiexec.exe Token: SeSecurityPrivilege 1296 msiexec.exe Token: SeTakeOwnershipPrivilege 1296 msiexec.exe Token: SeLoadDriverPrivilege 1296 msiexec.exe Token: SeSystemProfilePrivilege 1296 msiexec.exe Token: SeSystemtimePrivilege 1296 msiexec.exe Token: SeProfSingleProcessPrivilege 1296 msiexec.exe Token: SeIncBasePriorityPrivilege 1296 msiexec.exe Token: SeCreatePagefilePrivilege 1296 msiexec.exe Token: SeCreatePermanentPrivilege 1296 msiexec.exe Token: SeBackupPrivilege 1296 msiexec.exe Token: SeRestorePrivilege 1296 msiexec.exe Token: SeShutdownPrivilege 1296 msiexec.exe Token: SeDebugPrivilege 1296 msiexec.exe Token: SeAuditPrivilege 1296 msiexec.exe Token: SeSystemEnvironmentPrivilege 1296 msiexec.exe Token: SeChangeNotifyPrivilege 1296 msiexec.exe Token: SeRemoteShutdownPrivilege 1296 msiexec.exe Token: SeUndockPrivilege 1296 msiexec.exe Token: SeSyncAgentPrivilege 1296 msiexec.exe Token: SeEnableDelegationPrivilege 1296 msiexec.exe Token: SeManageVolumePrivilege 1296 msiexec.exe Token: SeImpersonatePrivilege 1296 msiexec.exe Token: SeCreateGlobalPrivilege 1296 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe Token: SeRestorePrivilege 2784 msiexec.exe Token: SeTakeOwnershipPrivilege 2784 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
rfusclient.exepid process 3016 rfusclient.exe 3016 rfusclient.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
rfusclient.exepid process 3016 rfusclient.exe 3016 rfusclient.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerutserv.exepid process 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 60 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1516 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 1584 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe 3676 rutserv.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2a6e6b54b6457078087ac12858f106b9.exemsiexec.exerutserv.exerfusclient.exedescription pid process target process PID 4068 wrote to memory of 1296 4068 2a6e6b54b6457078087ac12858f106b9.exe msiexec.exe PID 4068 wrote to memory of 1296 4068 2a6e6b54b6457078087ac12858f106b9.exe msiexec.exe PID 4068 wrote to memory of 1296 4068 2a6e6b54b6457078087ac12858f106b9.exe msiexec.exe PID 2784 wrote to memory of 3052 2784 msiexec.exe MsiExec.exe PID 2784 wrote to memory of 3052 2784 msiexec.exe MsiExec.exe PID 2784 wrote to memory of 3052 2784 msiexec.exe MsiExec.exe PID 2784 wrote to memory of 2568 2784 msiexec.exe rfusclient.exe PID 2784 wrote to memory of 2568 2784 msiexec.exe rfusclient.exe PID 2784 wrote to memory of 2568 2784 msiexec.exe rfusclient.exe PID 2784 wrote to memory of 1924 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 1924 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 1924 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 60 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 60 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 60 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 1516 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 1516 2784 msiexec.exe rutserv.exe PID 2784 wrote to memory of 1516 2784 msiexec.exe rutserv.exe PID 1584 wrote to memory of 2112 1584 rutserv.exe rfusclient.exe PID 1584 wrote to memory of 2112 1584 rutserv.exe rfusclient.exe PID 1584 wrote to memory of 2112 1584 rutserv.exe rfusclient.exe PID 1584 wrote to memory of 3016 1584 rutserv.exe rfusclient.exe PID 1584 wrote to memory of 3016 1584 rutserv.exe rfusclient.exe PID 1584 wrote to memory of 3016 1584 rutserv.exe rfusclient.exe PID 2112 wrote to memory of 2192 2112 rfusclient.exe rfusclient.exe PID 2112 wrote to memory of 2192 2112 rfusclient.exe rfusclient.exe PID 2112 wrote to memory of 2192 2112 rfusclient.exe rfusclient.exe PID 1584 wrote to memory of 3676 1584 rutserv.exe rutserv.exe PID 1584 wrote to memory of 3676 1584 rutserv.exe rutserv.exe PID 1584 wrote to memory of 3676 1584 rutserv.exe rutserv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a6e6b54b6457078087ac12858f106b9.exe"C:\Users\Admin\AppData\Local\Temp\2a6e6b54b6457078087ac12858f106b9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{7C569D2B-32CF-4170-9E85-4A42382AAAB4}\host6.10_unsigned_unsigned.msi" /qn2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 04AC72EB31B77C9D5E37EE920BD9F0BC2⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{7C569D2B-32CF-4170-9E85-4A42382AAAB4}\host6.10_unsigned_unsigned.msi"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: SetClipboardViewer
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Remote Utilities - Host\Arabic.lgMD5
f6ea3881bd23cb0ee957993fee23c6b4
SHA1fdd6e4cc3ed79e7ee06a6bb5095cbf2904684e81
SHA256e6f350f2cb7dd59c3806b346af9be54f490641d06e573b3ea7ddf7ce5c529078
SHA512a34840f3e4543228891f086d4416d3da538e7a9ee6182843bffe4bd0522c8090e2f87a5bdae194c8e3cf0cf0e8cef004ea39c0685b25012ea406868dce0d61b0
-
C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lgMD5
6d995e848c199a5c0c4128a28b07affe
SHA16de6724ba2b5ddb85c86abe353b421786daf89f1
SHA25609db4c31bede5f3a1000f32158c6f71f0380fcb73941e6826f4a3f5a36e868ff
SHA512d85a56df1729abff7cee06d42ae524432af3cbfe60fb841d198a9da896443ec342a06eea8fae06912378ec64551897d4eba3df4b086fb46272df90d26d80f5d9
-
C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lgMD5
0ed6a1984e883d26c3f04b7701ffa436
SHA1b06c8b34e7ed3f1cbec177da7c669c074c89a1f9
SHA256fafcd673fdaec9eb1631849d68cb08d807a340279eb0221b544ead71f5b2dc69
SHA51201326032709cee18b681c169c686a035293f80835500e46e277a5897ce8474ca937597a7a15323bb75dddce3bfafae4c4f9b872154f54779ecd7cd464cc4d06f
-
C:\Program Files (x86)\Remote Utilities - Host\Czech.lgMD5
8b0bfc75787bae7f7dc55e720e1a1472
SHA163c8d42de2526551fb8fd9f31f30e52ee92a13a2
SHA25681a15eae890f2051fea1f04c031dedba11b2b7cfc04a81223b1adac895033a0f
SHA512f348dee9e9c7e62556a0c111d1fa019120375f099f5d593144765be57fd196b05d6d3e06359cc15e7b181d0cb457b7d623892af5da915108e7a71cd29a08f956
-
C:\Program Files (x86)\Remote Utilities - Host\Danish.lgMD5
f621aa5d8a4d8bb667e73e1c05d6fe18
SHA12319c0afdbcd5d0c208581c05056b145e5d910d0
SHA256cbde3517ad89a72dbcb7a693be55cbc07f5d46e88bb28128624e21d400c02408
SHA512adc6ae4bb16c21f46a830d73d084a5ac7509aede6e86dbd1d424048d5ed431d3eb6f2158f627981ca432735c62f79f8023e3798c1f0e112f3ad8e67ef596d596
-
C:\Program Files (x86)\Remote Utilities - Host\Dutch.lgMD5
7c8f08d575e4a7cfa11a4ad6ddbe58ba
SHA1902a838ff647321ca5405dd95ef8e2374b0b4388
SHA256d4f47f4bf74574243afcf501eab3d4e9d0d5f7a624ac1139afd5db90615d9f9f
SHA512a020f88914628847d5e61c9999ee26fd01fafd5e87388130848d67be04d8a3603e64fd42320684196459510fa55c85a30d175538e1a24153be407271237b827a
-
C:\Program Files (x86)\Remote Utilities - Host\English.lgMD5
9a1fdea3797f3f8ee8f14bd2e053aff7
SHA1504ee198497352126e8256208d383c443cdf980a
SHA256dbfea93714fea4e7880aba1093f84975dc8b06f8b9c09e742b4a8565a638a4df
SHA512a7a7e7027431c2153a614e0d96552080dac53315fff793ae8b37dcf24e16500d62e761ac9384c45ef081fc573084fa9a93e11222e6dd162b33051e84cb142c7a
-
C:\Program Files (x86)\Remote Utilities - Host\French.lgMD5
2849bda8e859811129f91ef911a8c34c
SHA16d01aed37e3fe26b9c4bc2eedc5ca9e2b116649f
SHA256520968397ed6f5c0eab760dc33b0c0d8a13381f66d240810cfe58f07a6ee5cb5
SHA512f7568d9e79ccfa6231b066cef3f6ca8e8dea56ac9286662000dcccd5de0026b3637482e4222b4212a911d87c244377c265b139bead685d0ddf1b86dad40a1b13
-
C:\Program Files (x86)\Remote Utilities - Host\German.lgMD5
e3e6c94329a75d7197d283976d50ed29
SHA16a2c3ca6f6db2f5c1da2c454eb88a192cace4090
SHA25623e1a930e42edd46efbf49bae2cb6562e3da6e2b553b39cc2aee62ac24cdc844
SHA512fc07fd8985764c74c02b79053bc48ac5f19ecd240b17ef5297c9d6ce677981bacef39a0b9fcb9b9ef9832eb8d2ab6638e35c2428b14d41101732c3c27e4e1d38
-
C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lgMD5
00e28c3cd7737b444cd9fbde21bd4164
SHA10d80ced7c9818d07c29508538e463f7a36ccef33
SHA256a7e5178ebb640a20d9f3691b5c1bf13ef08d4d5d1ddc2322bda0bc99ec18dc0e
SHA512be6f06c1f2a52c7aa615cd3faf07f5b79db3a94d28e82e20598cfec5cb704b7db12448d2fdfc1c2716faa84379fd690f59a22d3ae9ca139f291e5d24007a8ab3
-
C:\Program Files (x86)\Remote Utilities - Host\Italian.lgMD5
9f2fb43c9393cef888ca546138db3391
SHA124a499e0109f07ab57f8e8de02621de6519ddea0
SHA256ba6d0413ceb84bc4e9a677472fe8f18599e3ab83c81c45179109f27d8b2d99aa
SHA512c523f0053128dceae4893151c93cd5c3d00554bab3ff00829e5b91b83edc0ebbd2f7439368a8387873c7d3e35f22ec682c44eb22f6c2fb08e6b534086c8d54b4
-
C:\Program Files (x86)\Remote Utilities - Host\Japanese.lgMD5
7683e967f436194a77c6c1fdd1b59b0f
SHA19eab3d831de2f6b970c144b88ead1bd720333db1
SHA2569e9bcecba94dcf8ce3ff9de9d0ffa77dddc37ff0f4b910761c9cd506c2e1030b
SHA5124e896d3d9368fdd8619eebd9d36405942b1441cf02d3f907ea3fb7641fe2ca11bf68782e2e72d19f498e5ec3ae5748435b1028bfbd9fc25161dc5e21b85f8e14
-
C:\Program Files (x86)\Remote Utilities - Host\Korean.lgMD5
915f8dbc7448f3bfb8354589ad2fc3cb
SHA18dc225137ba636edd312ad7b1b5397ff128adf41
SHA256692899e2cf25e6c8c358d3d3a63662970cb1aa7e63aac2cdee8ab1efcc6dbc55
SHA512aa3963655bc08c20efcb75a005f9c3d45e20785e13e803f59a25194f6656e3965e47e0ee6c68bda7ffb51be30676b4b5be7d388379a6d75c8fd0125eb512ef52
-
C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lgMD5
8b9a680cd0e581c35624f870f083b2da
SHA1c37417a00c0dedee94c57f6dc05a2c7f755ec600
SHA2561f8dc472a0105547f913a84c34192b078fdf0ca6da2e9a3125e3770090de6b49
SHA512b5f93428cfcfd3882b54c666df2ef695fa4e3baecb677bfdddc20a8c28fc635f1249e581e0f75069a49e64426825acab63124c009ce78407b01157730f85c983
-
C:\Program Files (x86)\Remote Utilities - Host\Polish.lgMD5
baaefbe6e3758c5b8d79fc5513b9f63a
SHA1c35716d506fe5b6bac4bd45d7e7be104c00a6833
SHA2562e3f5398fcf716600c72258de408392d3cee5901ccf30885042a3c2d3d3d9c74
SHA512df2bb8cf9972266ef5280d2e4beec5e122914c48f266442070a5cfb898610b6fb0f417941961d742269c243315662ae181981525bbb04aebabc583dd0f5d44dd
-
C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lgMD5
c3778e1dcb95065f7c2cba53d490d6b8
SHA1bf08a8a0eb47dcc5e848e955daa112c82c4519a5
SHA25638af7f5d7233b51adcbeca92ab28b146302ea6ad61bcfa4cdc765c2b60759f04
SHA5121edefb2cb065f836e4767e02b70c0a9ea080ba9b7a7f938b805be221eb516dbdb20e601aa28131517bf8125dd8966d55ec3a164d2be2a1f38e4b2fedffd17a6f
-
C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lgMD5
10f4324b24a9bd1b6c04cfc60f3f6405
SHA14e4c0fd79fec57a03211ee46028f7b0dd6a2978c
SHA25657a6b2490e64471a555015f5f32b544833aacd0cd53cb67e65d7081fee644d73
SHA512f7285f68baef6b987bb7c99c4221a26be488274750f8eccab12b4049ee07be9d8d7d0c7abb24bc6e42efa50697213be7e4350e964fe3281687a548c2690d924d
-
C:\Program Files (x86)\Remote Utilities - Host\Spanish.lgMD5
c9f142a80f4552867e8c87b680e90ba7
SHA1072df48fc1d5ed50db04f4bec9c4a3ed32d8db37
SHA2565c242b2a08d7ea452c6468c11e2b7a0882fb45caafa608e5e8c7661819539ec2
SHA512fe0671aa76c0682e95683a3b4482e1a63a894bdfe9a4a6735ae463e2c30df861377f67e48699859fe7c50d5cb7ed88ec4fd2f6622ac2d2b126550a8696765ab3
-
C:\Program Files (x86)\Remote Utilities - Host\Swedish.lgMD5
01583be353cff2a0b67803f4a43f394d
SHA17a924df31d9720a0bc5a40a501daa11ad83675a7
SHA25601b1a41beb45a4b31657ae347c6958527fe23866274e6432a027fd888c9df57d
SHA5124c715cbfe804afc1802981506b58ac714668d8afc9f7b9be4c8869f7300a0281090b21fcb4ffe6efc455d3a42da37d866139490fd604c2318ab46b02b3722d2f
-
C:\Program Files (x86)\Remote Utilities - Host\Turkish.lgMD5
5c8be08e6573e844677c918f843fc58d
SHA129959ebd91532107c8d4524238b3bb54d927e2c6
SHA256309003bd06b36380a7f53d92f2e8a3083cce6c01ed9b773a558ed2298d4a45a4
SHA51213affbf0d90b85043475d28f4346d8f4fd21ab2f1c64b8ee56a96e817786cfca7c42b46a7b1c11364e2ffd4148337dcb1cd108215055637ae78c2b27018f8ba0
-
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exeMD5
b308291b116f14939f59b9b63b98f007
SHA1bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf
SHA256d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80
SHA512f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exeMD5
b308291b116f14939f59b9b63b98f007
SHA1bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf
SHA256d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80
SHA512f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exeMD5
b308291b116f14939f59b9b63b98f007
SHA1bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf
SHA256d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80
SHA512f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exeMD5
b308291b116f14939f59b9b63b98f007
SHA1bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf
SHA256d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80
SHA512f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exeMD5
b308291b116f14939f59b9b63b98f007
SHA1bb39483fd874a13a4b5c5d23f56c88ebd00e1dbf
SHA256d1ec641ce4e2883c19a21863c3b21bf45bbf08040f19c4af99be640b43f99d80
SHA512f659191cbfcf459e81ebdc928f1723336da9ad07a3962da13d8dbbeababa2fab49c140c587a8c9a8dad14a9a6f506611f078ba4a20804a54f2fe76515b5b3370
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exeMD5
364ec0894d60d3cdd917561626084c5a
SHA171262de7339ca2c50477f76fcb208f476711c802
SHA256322ef7eee9de6bcda974e9e1509b1f1e96e3538078ab4874a106dbe34064b52c
SHA51237fbb090d0586e33087e6a93f9927d45e548d995d4b3d8c57f66308cb100e49c1f3c59ca9b618ed2d7798e1eaa04e0578501ebf504396e361973abb0be583bc9
-
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dllMD5
b734c92aece61a0471984b1fafb2db03
SHA117e5ef96d462ebc79e75472dc376ec7b65bfc5ef
SHA25678b2a0c2b220875d1111efcca49839f56af89ac7d17ab9f4dbbb2af817440a31
SHA512dd51116862a0434a7300c9532c03bfd07f04582da5d801e45ec41619555ecd0985fd521792cbe3f8ce47e087ed40c3ca2f1c8db0dda0ff0529c81e6452708aec
-
C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dllMD5
afdab890be73c9945d6e96dfafd0c997
SHA160e2b20c2ae650d664a820c9b9d799619ef97456
SHA256ced7a854946fb1a2ce6491c94acba9697d3b360ba4efd0e9e6450802d601c57a
SHA5128438aae312f344ac09906d9d01e9bb18835f970921e9a58ddec8cd6a20a7ea41820376cf7eee6c8e0068ef2089ff6d6c4bc875fe44331283c91bb5b95a1ea6e1
-
C:\Program Files (x86)\Remote Utilities - Host\webmmux.dllMD5
50784c57f4d034b33150b8dbe9b029ca
SHA1c393732f929851da135b71cf0b8d065f31a15dd9
SHA256b287fa75d93e08cad6fe680196a94a3693f9d4f3328e0066b82ca8088472055a
SHA512feb98808143caa1ab88187d96056ea1011f882799f608e3f59492d34eae1002f258fbbce99171a715545fffb3e2f2fc6a9c1a631f639d474eb074446f3ac7bd7
-
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dllMD5
c7b616d2ad36ed68aef3621b45cd0831
SHA1ea2da553244d43a60b9ddbedaeb02dcf7185ac5d
SHA256e609d5253483bafe10baa880a33968c98620ad753a557ef38c2ed4694a118585
SHA5129bdb3e76fa1533c862226438ba78a9112f41d7b431b8885bebf33ca170190f31cc4d05db641ec02728f08815fac4c1b73c98b04e26ce857bf298cee3ec05b408
-
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dllMD5
ff70441f6fd3eeb5a061c117a13da554
SHA1d8ca8841e636436c4d4c7ef0479c549b404a9983
SHA2564f8ef46af1591a5906dba229be6866d756f29778d562b503b30d967b1a75339d
SHA512c54d82d34b5e52097096357471156b8ad4f579b9b679b513fa063c25becc6cb0c54023f2ae5ec61a3a19a5d6b262a961ab3df970e431467488ad3196fd2c2882
-
C:\ProgramData\Remote Utilities\install.logMD5
d33e33d49ce650471dffd7aa3c27fb70
SHA119f0077a77f49bf391fea5623c4a2b1004e37804
SHA256ff6393c30f1befd1fdd14c4549d1e65507d71870fc8ffe5b196536f43984a213
SHA5120866922e2de674bd658953def8227ed3439847b5455ce35ef4fa08d8e26195ab5aa6fa348c79f461d581024a76f08636b878b12838051d04b68513a26e2c36b9
-
C:\ProgramData\Remote Utilities\install.logMD5
0d982e5591ea6794c1c2df25c5c40e67
SHA1142cd97911f3e9195eb4ea755e9c0fe0f7f326a1
SHA2565f79c1a7e8d4ca07af978d2db9db6dacf84be7e88fac6c61bef8e9ba7eebbdc8
SHA512ee57cb4b43f60ed21d476cdab4e4fdb4f68c0dd9dbcc6148ecd2e239da8cb19046df2881f1cfd4edb4b67ca534d59d2db0a3c9267a5d5c5dc234b613a15e7587
-
C:\Users\Admin\AppData\Local\Temp\RUT_{7C569D2B-32CF-4170-9E85-4A42382AAAB4}\host6.10_unsigned_unsigned.msiMD5
e7cee6f280d6ceed2136c046caf7e046
SHA113809810771fa66d5768bb41cdcf413c15d67660
SHA2567b52eecf767f6fcb43a96fec41615e055a17b6b6664885c9ea950cacc8df7cd3
SHA51218fda9eec5753d554cdcd37ba0dacae3470f8b7692bd8528d5d0e22aa2d18db09dd11b900efbd157b6a9b6e19ace23cb03b97f430d3c3a1c96caea8c3db59e1b
-
C:\Windows\Installer\MSID4E5.tmpMD5
52185b209cfdb02d88b4a40a4bdf0911
SHA1aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA256756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
SHA5128493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
-
\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
\Program Files (x86)\Remote Utilities - Host\libeay32.dllMD5
146dfe563aeab6edb51eb24c37494251
SHA1f54a31a9211f4a7506fdecb5121e79e7cdc1022e
SHA25623b0ded7bf70d07d04c3ec04f3f7380b693e395bdb9fb62ff1d5b0684b9dd42d
SHA5127df4636bcc10f09b00525069a39092ba19a9203b60f5f0fa5e254dbadc826e74642474262959ea9c88c00d97ca4abec8905fb8c2d50a963cf410012cfdeccc90
-
\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
\Program Files (x86)\Remote Utilities - Host\ssleay32.dllMD5
7450078342329c700f7fef4f84c11cde
SHA118ee67c1a9e7b9b82e69040f81b61db9155151ab
SHA2569f2ebc122d4f51f37877b00b3cad3d639936b2046498a6b05a191f9a9525ac67
SHA51207c0480ef354d8805f3a0ee6d33eed18d1352a3978cbfb01f4a521300f6a072f29c6f190c138dabef76fbff81625dc5b3e1574f1385d0ab6f8b22ad69122f316
-
\Windows\Installer\MSID4E5.tmpMD5
52185b209cfdb02d88b4a40a4bdf0911
SHA1aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA256756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
SHA5128493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
-
memory/60-141-0x0000000000000000-mapping.dmp
-
memory/60-145-0x00000000015C0000-0x00000000015C1000-memory.dmpFilesize
4KB
-
memory/1296-121-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/1296-120-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/1296-119-0x0000000000000000-mapping.dmp
-
memory/1516-146-0x0000000000000000-mapping.dmp
-
memory/1516-152-0x0000000002EA0000-0x0000000002EA1000-memory.dmpFilesize
4KB
-
memory/1584-155-0x00000000001D0000-0x00000000001F3000-memory.dmpFilesize
140KB
-
memory/1924-133-0x0000000000000000-mapping.dmp
-
memory/1924-135-0x00000000012F0000-0x00000000012F1000-memory.dmpFilesize
4KB
-
memory/2112-183-0x0000000000000000-mapping.dmp
-
memory/2112-187-0x0000000000AF0000-0x0000000000B9E000-memory.dmpFilesize
696KB
-
memory/2192-189-0x0000000000000000-mapping.dmp
-
memory/2192-191-0x0000000000AF0000-0x0000000000B9E000-memory.dmpFilesize
696KB
-
memory/2568-130-0x0000000000000000-mapping.dmp
-
memory/2568-132-0x0000000000BE0000-0x0000000000D2A000-memory.dmpFilesize
1.3MB
-
memory/2784-124-0x0000024FA16E0000-0x0000024FA16E2000-memory.dmpFilesize
8KB
-
memory/2784-123-0x0000024FA16E0000-0x0000024FA16E2000-memory.dmpFilesize
8KB
-
memory/3016-188-0x0000000000AF0000-0x0000000000C3A000-memory.dmpFilesize
1.3MB
-
memory/3016-185-0x0000000000000000-mapping.dmp
-
memory/3052-126-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/3052-125-0x0000000000000000-mapping.dmp
-
memory/3052-127-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/3676-192-0x0000000000000000-mapping.dmp
-
memory/3676-196-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4068-118-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB