rurat | 20ab498b278b14f3786f634778a04d219c74e9fd8517b98f4aca313c9934b7f2

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2024 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Електронний план евакуації.exe
Size

20.1MB
MD5

9b40a1519801020305e31e553a3e82ab
SHA1

cdb31b4af42b3fb27527839ecf26d1c26f2a5d06
SHA256

5158482849c818c270f302c1dfa06d770ed2b5056cf393d60fd56817636866da
SHA512

57fb1869dee12253b97d787e26398ee2cd00c8bea8feaa737ffe0c61f5cad342a956cc0357cfb3551d31425df5cf857db560b3b97d16e57d5a8596d45f42bca9
SSDEEP

393216:zTrD0wz5HtKIdVtvz75Un+2PJ3L6LBQ45TDmZmLCAJ+JuuPUg9ScrRl:TgwdHUyVtvz75Un+uhs5TWmODgyaA

Score

10^/10

rurat backdoor trojan

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Електронний план евакуації.exerfusclient.exerfusclient.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	Електронний план евакуації.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 9 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exerutserv.exe

pid	process
2988	rfusclient.exe
3232	rutserv.exe
552	rutserv.exe
1864	rutserv.exe
1608	rutserv.exe
2108	rfusclient.exe
1260	rfusclient.exe
3300	rfusclient.exe
4332	rutserv.exe

Loads dropped DLL 11 IoCs

Processes:

MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
452	MsiExec.exe
3232	rutserv.exe
3232	rutserv.exe
552	rutserv.exe
552	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

10 3268 msiexec.exe

flow	pid	process
10	3268	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 8 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe

Drops file in Program Files directory 55 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}	msiexec.exe
File created	C:\Windows\Installer\e578774.msi	msiexec.exe
File created	C:\Windows\Installer\e578770.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e578770.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 48 IoCs

Processes:

rutserv.exerutserv.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\ProductIcon = "C:\\Windows\\Installer\\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\AuthorizedLUAApp = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADD21FF3AD83F6644B3E7657CAFE5583\RMS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\PackageName = "install.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\PackageCode = "18BC6BFBD2A8CF147A73C58FBE730039"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Version = "117571586"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exerutserv.exe

pid	process
2988	rfusclient.exe
2988	rfusclient.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
2108	rfusclient.exe
2108	rfusclient.exe
1260	rfusclient.exe
1260	rfusclient.exe
2108	rfusclient.exe
2108	rfusclient.exe
3300	rfusclient.exe
3300	rfusclient.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeCreateTokenPrivilege	3956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3956	msiexec.exe
Token: SeLockMemoryPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeMachineAccountPrivilege	3956	msiexec.exe
Token: SeTcbPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeLoadDriverPrivilege	3956	msiexec.exe
Token: SeSystemProfilePrivilege	3956	msiexec.exe
Token: SeSystemtimePrivilege	3956	msiexec.exe
Token: SeProfSingleProcessPrivilege	3956	msiexec.exe
Token: SeIncBasePriorityPrivilege	3956	msiexec.exe
Token: SeCreatePagefilePrivilege	3956	msiexec.exe
Token: SeCreatePermanentPrivilege	3956	msiexec.exe
Token: SeBackupPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeDebugPrivilege	3956	msiexec.exe
Token: SeAuditPrivilege	3956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3956	msiexec.exe
Token: SeChangeNotifyPrivilege	3956	msiexec.exe
Token: SeRemoteShutdownPrivilege	3956	msiexec.exe
Token: SeUndockPrivilege	3956	msiexec.exe
Token: SeSyncAgentPrivilege	3956	msiexec.exe
Token: SeEnableDelegationPrivilege	3956	msiexec.exe
Token: SeManageVolumePrivilege	3956	msiexec.exe
Token: SeImpersonatePrivilege	3956	msiexec.exe
Token: SeCreateGlobalPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rfusclient.exe

pid process

1260 rfusclient.exe
1260 rfusclient.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

rfusclient.exe

pid process

1260 rfusclient.exe
1260 rfusclient.exe

pid	process
1260	rfusclient.exe
1260	rfusclient.exe

pid	process
1260	rfusclient.exe
1260	rfusclient.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
3232	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1864	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
1608	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe
4332	rutserv.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Електронний план евакуації.exemsiexec.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 2224 wrote to memory of 3956	2224	Електронний план евакуації.exe	msiexec.exe
PID 2224 wrote to memory of 3956	2224	Електронний план евакуації.exe	msiexec.exe
PID 3268 wrote to memory of 452	3268	msiexec.exe	MsiExec.exe
PID 3268 wrote to memory of 452	3268	msiexec.exe	MsiExec.exe
PID 3268 wrote to memory of 452	3268	msiexec.exe	MsiExec.exe
PID 3268 wrote to memory of 2988	3268	msiexec.exe	rfusclient.exe
PID 3268 wrote to memory of 2988	3268	msiexec.exe	rfusclient.exe
PID 3268 wrote to memory of 2988	3268	msiexec.exe	rfusclient.exe
PID 3268 wrote to memory of 3232	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 3232	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 3232	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 552	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 552	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 552	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 1864	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 1864	3268	msiexec.exe	rutserv.exe
PID 3268 wrote to memory of 1864	3268	msiexec.exe	rutserv.exe
PID 1608 wrote to memory of 2108	1608	rutserv.exe	rfusclient.exe
PID 1608 wrote to memory of 2108	1608	rutserv.exe	rfusclient.exe
PID 1608 wrote to memory of 2108	1608	rutserv.exe	rfusclient.exe
PID 1608 wrote to memory of 1260	1608	rutserv.exe	rfusclient.exe
PID 1608 wrote to memory of 1260	1608	rutserv.exe	rfusclient.exe
PID 1608 wrote to memory of 1260	1608	rutserv.exe	rfusclient.exe
PID 2108 wrote to memory of 3300	2108	rfusclient.exe	rfusclient.exe
PID 2108 wrote to memory of 3300	2108	rfusclient.exe	rfusclient.exe
PID 2108 wrote to memory of 3300	2108	rfusclient.exe	rfusclient.exe
PID 1608 wrote to memory of 4332	1608	rutserv.exe	rutserv.exe
PID 1608 wrote to memory of 4332	1608	rutserv.exe	rutserv.exe
PID 1608 wrote to memory of 4332	1608	rutserv.exe	rutserv.exe

C:\Users\Admin\AppData\Local\Temp\Електронний план евакуації.exe
"C:\Users\Admin\AppData\Local\Temp\Електронний план евакуації.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i install.msi /qn
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 75751C8F2809F423C744E372593F2A13
2⤵
- Loads dropped DLL
PID:452

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\install.msi"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:552

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2108

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3300

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e578773.rbs
Filesize
41KB

MD5
24e8587b0845f8edd24761a8516f5e64

SHA1
ca3f237059c6fcaa815f4ededcec083950b0485a

SHA256
fddf49cc144f4fc5d9c749af86ff9ec5feceb57e82198ed242f90be591e0747a

SHA512
2a30416e3013d8f5761f805129de8e3d5a052f3fa8628d5dd071ac0093e47bf50e295e594b9253115ef913f630f4b03bb979d43a28d204452ea192340f7dd3d0

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Filesize
52KB

MD5
b2e6147f97dae696265a089f98ce8106

SHA1
418f20ec486b7a9368ceff183e7cebae9ba52101

SHA256
44917b2c260fea3a0f4691f6e986c25e31b3f9ff22dcd055526199b4d8a54051

SHA512
789dd02281b71fab54f42b92b5c0c76c0266c40100dbe532ad3ebbf968e8a9e674f0be57e2ffdb10eb4a6b4faa15a6a6a92907c020c6cd2990427d890d7f5026

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
362KB

MD5
ef43dc667276d8a180c0ca9b5002ebef

SHA1
52f147b59cc98692546d458580772c339e6d455e

SHA256
19edf60890f50d13d972a166fbee7d71582ea55c7b9dbd6c953d540005e472e1

SHA512
b8ba045ebee438d5abfb6b725acce80d5f00c34e486dbdf705b85c4d4507722b0759550128679f5cf130f2019999d39672617b13d0a57f5ff616181099213544

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
523KB

MD5
acc6f652e577cf7102e11b9810c54943

SHA1
9dafa4e63b2324f4514d61f258b29f6ff4bc5919

SHA256
5863dd8cbe7c411f3242b42d6c47dc205e8c7c6a9d7214558952bbae6d4732fb

SHA512
fe6b4e8518d118cdd6eca0d49ccb63d3338e1896d7acd1728b3b762ca88c779c15d516e3c8b87d84d6a9e20df15666434a4f87c928e68fad95745e9317720063

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
682KB

MD5
ecdadd100e3178e103651f615cde1fab

SHA1
e707d639b3cd5521ba3e7d0750890d0e55efaf51

SHA256
9272a5bb7300d163615defa33137e5e95738a65e23b0902d892e568c720ca150

SHA512
ca14155210b8f87cc1a95e1d7af277741de5d8daf6ad25d3fe25c956017753dd7f96a65b76d84ce63745ab8f87c2f6d22f32f35ccbc0f2a001f8d89c3508eb49

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
163KB

MD5
c8987007a7739de2c3e65872d85d92c2

SHA1
9907b62e0b7a2b6960d9360d1cf325d504f2a2c4

SHA256
fb752d69b4edf110e081c5061394cd1d14a076d66ec39c0ce6bc101a8c90729d

SHA512
85ee35c356aa00b8146cc21e5619b8e1809794988ccc51c292dc348ff14d6cbf4551586aaf4f84fc9b3cdba9de7f17e77a9ff32b21ac01cc43f144d37f5f12c6

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
282KB

MD5
f9d4f32eaf69e0df65fe37e9940655f0

SHA1
e33abe47a2b1c579905ca58fb617c2bb6e9be418

SHA256
b4b90777fe2ca31941c0ee8160008dabf5d7c795811597bb572ee03be5e3d40a

SHA512
8a313de737634a62d262ad7d214af2ca617dc4743275b5c95733122db70c1dd6486ea5e0a1c0fbbb2273d7679559e1d382703e9494b3549782f6ed0b29277b4c

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
143KB

MD5
8a3e186c82dce38c35bac3ec79313bea

SHA1
53da128d03b1f4928172aae84dfaee34deb982be

SHA256
8f2dbd294cda7b70b4ec1e165bee2ce0d349da789d400acd12a0e6af492b9b17

SHA512
dbd1042090b8432cec85640a865d857d0bcdedf773a1b5733e09dd425c878b92aa4a98a1ed6128e166c34685086a195d3f427e0fb6f0aacf9a1ffa8bae7b4cf6

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
80KB

MD5
35ea30f931077b3ff36080f758e820e9

SHA1
5455425ba6811cbd6ca3ec50fdf334b44f345dc5

SHA256
309d9717363023cb73a8c91b2bc4d3695de194355e1db73d0121364e323103c3

SHA512
9859671beaee1d6d136476fe2e3f9ec3d99bc7c88432ee70fc7cbad621e3a0c7085eef81705d433b787cf2e8bba7125f0c4e16233ff91a8926a7f2507b9d2917

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
100KB

MD5
505b42843571d4ecc530a26bab174238

SHA1
6ba4a0e34c466f99d5e4ed70d43379461d2f10df

SHA256
882921966e46ef7bcdd1151722a70b6c8545f83240748f58d0a03c80283577e8

SHA512
6e0e61fcfdcc2bf6cd03d909c81c95794735377d92c398e6e1a355eafd553ea026def6b74f4366081e80570b8070d3ed31928ef6b3f04ead4b1fb64da3693041

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
99KB

MD5
02c8c0c085cb7e54fafa048f1af1e2d2

SHA1
a8fb809b245cf5ae055e3dac6f5f61ef2e379572

SHA256
17a27eb638e7e3725cd1954414f863f99eff3116cc09a958e9c883e7a72754f9

SHA512
aad2b5dd739c4090517e1e721613da7ed003ae3fd686fe5cd9406a20eb0beb056d5fcb06e542623f762f43aca71c178c4daca6f2a2d2841bceaa4f0e15c1af37

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
4.8MB

MD5
8c29fb37fa8525f27a85ab32de436012

SHA1
806b9e9f3e8f1dd78b2f5df64552a54d42132da4

SHA256
302153d4ea683d89d84e6724d57b8875ebffda279c9f67c34f43b2d2a4f90c4d

SHA512
379aa610d62f2750f97f1606f5a25df82511bba7bffbee122f22dec6568f477e95c24548c16cf011450003b062336d43d31592faed7c020e60995c53049a46e3

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
4.8MB

MD5
765ee741043865609f28e642baa00dc0

SHA1
2f255500697004fab92a316d6fca08f7c36c8680

SHA256
6d9b686d29186c3be83eece211cbe4fa666f849abb76f92829ecac045dd79369

SHA512
7d0a082dcb863d5fdacfdcaedb015ee9c404f6206e0e260fe0ed21348554c7e3acd32ec8245071dc67f1cc8358eb5ad3067a941d0c1a148ff75f04500bdeac3a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
610KB

MD5
30bb47cd6782305398967188aec68399

SHA1
bffb8b4c61b89246b7bcc13528854670813c15ac

SHA256
325c971a4e5e86327e07ef40633356178bf700b5338d16ffbbb432a07fba71a3

SHA512
ba3ebfe6dad0cad05d6436c62c09f1cfa5f8a81152b554b9bdb317db80841c358fdf769af035da19196b7a4f05c7e5f92bfbf3ae5b3ccbc0c9d44a319535e2db

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
137KB

MD5
5545af0220c2ca28a6fe964d487400da

SHA1
56d00a417731e92b6b14da6ceca164a4b5d4df9e

SHA256
6a537f4d48f5f6ef91792b7c71cf352704e3cf46559ca266d3abe7407c3fbc57

SHA512
1cf5d395cadcb6ce07734bcbddec899ee6ca288d8fd9100efe9c694b9eaf3a4d2e7eefaa904c3a8063f42355c8ed4b8da9c72a0eb73bfc305ccc1d1d60ad125f

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
123KB

MD5
139ad5e90193cd2d19bdc16bc4f78b4a

SHA1
6010c6b2f292c016eb64199c2a59baa657d61a29

SHA256
5e9331395c4188571fb34683f3adf3009a95d572cee66fa8a6853a570b1c5ca6

SHA512
5de11174944620a1562b847466bb50afbdac5f33ec06658309575c84b05844a9e794bec2b63b77e80d6e9f2a7f7bfbf1c7b8c567d882f6b0f504511e6d946cbf

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
195KB

MD5
fc11a9fe5454528ebf052db638617028

SHA1
876d0932dca330cdbd84d2fb68febd854d1c8161

SHA256
d8abf818e947b345fbee385b6d26c472e0b1c82308674e40416182b4f147ce7a

SHA512
96ece1dd2c2923e04a174b0b6d230df4b2082447af2b667bcc6dc7ef082b34f00e55bf42385bf2a905bed7d244cac0626fafc40bd34522544c6feca26828fd10

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
1.0MB

MD5
a50ff5d2caba3fd3c0059757489f45b3

SHA1
f9010631a8bbafa7af9818bea546cb13aa392225

SHA256
e94241f81d2402f32e022b7ad20de2467e78908daa783459dc6c845ff887187f

SHA512
bb7b29a406a893e17cbec81fd71adddd9dd5fb798d13fbf775d07f20ae537a370d93b7edb952cc3a3eeeb05ece0b90b3d37449860cdfac29fcb0d2aafcee5f31

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
977KB

MD5
98347c7758b673f7b3b2de8af70f6cd3

SHA1
53b85dc2c8c3919be82b9f78fa2b01ccc4d5f828

SHA256
df1751a4345a0fe59cbd4d7b3573ce3ab1f4da2e85c12f6bc6ac45d07faa4612

SHA512
c6b7233848e8032abb3241737029b0446cdf8b9335346fa1bd0fc5aca4ef5e3d5f616bfa4d37229a3bc54bd54512d5168c9a2e6a0d271190e1454545eecf51a5

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
333KB

MD5
1103586f551d0e20a2de6e2b7004487a

SHA1
8c68c8a5ec3b4a4fa21039e724ab49d19ba1a2b9

SHA256
478ee116a80bc863c021581721ef0e66abb3d6284c194079672a9abc30e74d2b

SHA512
d34a96498374d46903db593da743e2a9288f90f850863eac64da19de9ce3c7eac20d4d3510fa23e2963575ea0c54116a9d8d531a345fe0d374737957a3e56ef2

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
317KB

MD5
30cdd06e9dc96ee9c032ae09acde0b6d

SHA1
d8d2bb4aee59d0992ae56e0c56594ca0e222026a

SHA256
accc43718da6a3574df80942ed2e63a86f167130916d622ba1dbb65ebc0db708

SHA512
1f766b07cc9030f8089f7a863bf8698840114039ce860ece81648e16b094dfe57643af83f6b6273bc22210563f366bf1997816bfe2b3d5ab40b269b254878c50

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
338KB

MD5
74f9696be4b46f04a1263c3181405c35

SHA1
cf66b349beaa2bc25ed5807763e32018e4304c7b

SHA256
d6e8bee1a9476ed3be229f4be81cc1154f1ed425e50e74fd1abcd76c56ea062c

SHA512
f122e00b795476809994733028346d82945566ce4c2be26444f02e077658ccb1ba0f3fe221cef37837941054fe4b3b54b3f9a74861f890e56544d1453823fd68

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
82KB

MD5
7ccca596f989dd52a126027f9a2da6ae

SHA1
05d711df40a8951c981a028cccd9cee2e95d26b4

SHA256
413587936ee3a84f6dd3fd2442248159d0b309d230a1e2c69d09c19c3abd92c3

SHA512
f88c6f3d6bda1d3404cd6e72ad6b8503a2fd7e411227383974f12925a50befa170d70f100f6aeef77507e620f3a529a31eaaa6a9f547ce2b199cf1c93013f371

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
222KB

MD5
e77f49b4ce0735e76e5bb6c5a2529168

SHA1
c97678476be94493d0fa83bf952ea026338b8cc4

SHA256
aa489122983e342f8f9f637a3af28a0b7c630c62bfb2f64d5b426341b41fd25b

SHA512
844ce91114acd9eccb6303f646f9494f91ed0c596a1ce74e48363800e09153d9f833302de487b3e465a8ff05c1654ddb913e36cdcbab91a994a83c77a00351d7

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
189KB

MD5
22ad7532c942d86ecfa777003fc4a3e7

SHA1
a137d8c048f75bb438065145394891ac92774d4c

SHA256
434e0bae55a2abb5bf1acf20213a59c24a29e5d2790bc42f52caaa858cf59f37

SHA512
89a0a0dcf131e91f06225d053a7a8cccdab4c9a1eae6160162c24f1c95ce7eeef62eb7bd97c622942975cab90e3437e6f9f8c0e53d95b7ca8ae49b79bbf493ad

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Filesize
380KB

MD5
c14000f68306f1cf0ec799df9568ae01

SHA1
788d8d7a0ba86ba6c7ef4f7ae50cdc65ddb348ff

SHA256
53b040341ce80f246c8437a99df5252a48801e2154eb94dc50af54a75d8d85ac

SHA512
2d4769949832794ce310474f843b696ea8eeb819554ecd72c449981988a6f8fbc5155d84a97d8a4c015348b3dfe6708f88c64b257d4a4d0d4a03dd068dda4113

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Filesize
207KB

MD5
1d97b343040f9d66f2276c484631bed0

SHA1
715035e7ef05590b6b6034839ae0deaa41f60e9f

SHA256
b4c7635d3ebc5facc7da49017ce96ba8b18c889f805f8edec4d575e6df038e7e

SHA512
7b86785d5bed0637da6eae537c4c2f6042e1f676d5737aebf21801c04c5ccbab903e476a9bdf262bb8ec271ab58e38f790991b59dbe35337ac73fd4ba8c7bf5a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Filesize
197KB

MD5
19c08fd973a6a2eea9745b2b186e12d1

SHA1
86cf47f2248d0620a9718e5b044a0eade2e38638

SHA256
a46145063b2812c940a3e579a80d7e6875da170a02eb9ef216f8e92c7d1c94ba

SHA512
52f0ed7903853b88506eaa8be86b94561414fda04ffdcaf7637849f4f338c10a95651ac0c481ae653e6381930697722409dfb80186a0ba4cec7e7627d1348440

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Filesize
255KB

MD5
4ab063a3765aaf6920b5f5607a8186c2

SHA1
ca4dd8e7093a0e1e090d7f27177a71d8cbd20fe0

SHA256
837a92b1bc837ae2de1a363c92f35e3fa4b90a569dc8eb62d06e4bd1163f61b1

SHA512
9d23180b007cc4a27364e44be6c0d79b0206d2363ffbbcd7e21810c14bb482d26e250bec2421260280a1aba068aa15cc22e926fff22513f645ab38c9ed3c0b13

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Filesize
447KB

MD5
2e0ce7ac24fd1d0df0ba370d51ad7221

SHA1
2e4020debccd04fe2873ac2c16f32c669a29ad6d

SHA256
0bf861b44d12004f24db1087fafb4f68cc41f56cf0f5c847f27849a3dbbf8104

SHA512
f8ef541b171096f98b9be988cdf9bcaaa00b7d47ceb4612221c3c11ce8faf02faf6a791886618457164020dfb8f88a7a87f3661c45b31bc21557373ec2a838ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.msi
Filesize
21.6MB

MD5
f54fd78880d87f1021cefcdafb516ff8

SHA1
4b46b0ea729abf629899bd2d74149b524b9767a5

SHA256
06956bb4eee98f34f035af11666459b2f9fc5f7485b2cf16f6afb17bfa15a061

SHA512
9b25552a6d91e4db3b7a9f04896810f0a77d29bc86a7b7c2cda72bc50a5326c567d12b2075f95ea9dc92510989a2ae16f57a9e3003de846041f7e6dd244e06ea

Download Submit
C:\Windows\Installer\MSI89E1.tmp
Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
C:\Windows\Installer\e578770.msi
Filesize
4.6MB

MD5
d856f82d82a587c3655644ca0aab0abe

SHA1
5f07411072129b7883a74a399bc4e720e87bfb3e

SHA256
b3de2f1a8fe1b1dac2f67f34fd576256a59433655347d0033d9621f6d442de1c

SHA512
07bc787f50aca36142de72589511055aea95c3dec4663e3f3737bf4f7302044d471e701177b128aee3116382727974a9bd8da617c1eee741ce102f0cf3febdd8

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/552-179-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/552-112-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/552-116-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1260-251-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-200-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-235-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-243-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-239-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-247-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-226-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-214-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-204-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-231-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-196-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-191-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-192-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/1260-222-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/1260-163-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/1260-180-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/1260-173-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1260-174-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/1608-133-0x0000000003B50000-0x0000000003B51000-memory.dmp

Filesize
4KB

Download
memory/1608-143-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1608-162-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/1608-154-0x0000000006540000-0x0000000006541000-memory.dmp

Filesize
4KB

Download
memory/1608-253-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-249-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-245-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-160-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/1608-241-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-181-0x0000000003B50000-0x0000000003B51000-memory.dmp

Filesize
4KB

Download
memory/1608-182-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1608-183-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/1608-159-0x0000000006140000-0x0000000006141000-memory.dmp

Filesize
4KB

Download
memory/1608-237-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-233-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-229-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-189-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-219-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-158-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/1608-156-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/1608-194-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-155-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download
memory/1608-198-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-150-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/1608-202-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-153-0x00000000063F0000-0x00000000063F1000-memory.dmp

Filesize
4KB

Download
memory/1608-149-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/1608-224-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-136-0x0000000003E10000-0x0000000003E11000-memory.dmp

Filesize
4KB

Download
memory/1608-146-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/1608-207-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/1608-144-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/1608-220-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1608-145-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1864-126-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/1864-157-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/2108-172-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/2108-190-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/2108-171-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/2108-161-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/2108-170-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2988-92-0x0000000003910000-0x0000000003911000-memory.dmp

Filesize
4KB

Download
memory/2988-94-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/3232-99-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/3232-110-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/3232-109-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/3300-186-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/3300-187-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/3300-188-0x0000000000550000-0x000000000106D000-memory.dmp

Filesize
11.1MB

Download
memory/4332-211-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/4332-228-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download
memory/4332-210-0x0000000001B20000-0x0000000001B21000-memory.dmp

Filesize
4KB

Download
memory/4332-212-0x0000000000070000-0x0000000001560000-memory.dmp

Filesize
20.9MB

Download