rurat | 20ab498b278b14f3786f634778a04d219c74e9fd8517b98f4aca313c9934b7f2

Resubmissions

19-02-2024 13:09

240219-qd2rpsdh42 10

19-02-2024 12:34

240219-pr4b1sdb8w 10

22-01-2024 20:46

240122-zkqsfsdgf8 10

22-01-2024 16:08

240122-tk9bxaadck 10

Analysis

max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Електронний план евакуації.exe
Size

20.1MB
MD5

9b40a1519801020305e31e553a3e82ab
SHA1

cdb31b4af42b3fb27527839ecf26d1c26f2a5d06
SHA256

5158482849c818c270f302c1dfa06d770ed2b5056cf393d60fd56817636866da
SHA512

57fb1869dee12253b97d787e26398ee2cd00c8bea8feaa737ffe0c61f5cad342a956cc0357cfb3551d31425df5cf857db560b3b97d16e57d5a8596d45f42bca9
SSDEEP

393216:zTrD0wz5HtKIdVtvz75Un+2PJ3L6LBQ45TDmZmLCAJ+JuuPUg9ScrRl:TgwdHUyVtvz75Un+uhs5TWmODgyaA

Score

10^/10

rurat backdoor trojan

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Електронний план евакуації.exerfusclient.exerfusclient.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	Електронний план евакуації.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 9 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exerutserv.exe

pid	process
932	rfusclient.exe
4032	rutserv.exe
4852	rutserv.exe
4780	rutserv.exe
4224	rutserv.exe
4588	rfusclient.exe
4692	rfusclient.exe
3320	rfusclient.exe
4032	rutserv.exe

Loads dropped DLL 11 IoCs

Processes:

MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
440	MsiExec.exe
4032	rutserv.exe
4032	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

7 4608 msiexec.exe

flow	pid	process
7	4608	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 8 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe

Drops file in Program Files directory 55 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D16.tmp	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e574a96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\e574a96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F4A.tmp	msiexec.exe
File created	C:\Windows\Installer\e574a9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 48 IoCs

Processes:

rutserv.exerutserv.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADD21FF3AD83F6644B3E7657CAFE5583\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\PackageCode = "18BC6BFBD2A8CF147A73C58FBE730039"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\PackageName = "install.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Version = "117571586"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\ProductIcon = "C:\\Windows\\Installer\\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exerutserv.exe

pid	process
932	rfusclient.exe
932	rfusclient.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4588	rfusclient.exe
4588	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4588	rfusclient.exe
4588	rfusclient.exe
3320	rfusclient.exe
3320	rfusclient.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	4608	msiexec.exe
Token: SeCreateTokenPrivilege	4644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4644	msiexec.exe
Token: SeLockMemoryPrivilege	4644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4644	msiexec.exe
Token: SeMachineAccountPrivilege	4644	msiexec.exe
Token: SeTcbPrivilege	4644	msiexec.exe
Token: SeSecurityPrivilege	4644	msiexec.exe
Token: SeTakeOwnershipPrivilege	4644	msiexec.exe
Token: SeLoadDriverPrivilege	4644	msiexec.exe
Token: SeSystemProfilePrivilege	4644	msiexec.exe
Token: SeSystemtimePrivilege	4644	msiexec.exe
Token: SeProfSingleProcessPrivilege	4644	msiexec.exe
Token: SeIncBasePriorityPrivilege	4644	msiexec.exe
Token: SeCreatePagefilePrivilege	4644	msiexec.exe
Token: SeCreatePermanentPrivilege	4644	msiexec.exe
Token: SeBackupPrivilege	4644	msiexec.exe
Token: SeRestorePrivilege	4644	msiexec.exe
Token: SeShutdownPrivilege	4644	msiexec.exe
Token: SeDebugPrivilege	4644	msiexec.exe
Token: SeAuditPrivilege	4644	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4644	msiexec.exe
Token: SeChangeNotifyPrivilege	4644	msiexec.exe
Token: SeRemoteShutdownPrivilege	4644	msiexec.exe
Token: SeUndockPrivilege	4644	msiexec.exe
Token: SeSyncAgentPrivilege	4644	msiexec.exe
Token: SeEnableDelegationPrivilege	4644	msiexec.exe
Token: SeManageVolumePrivilege	4644	msiexec.exe
Token: SeImpersonatePrivilege	4644	msiexec.exe
Token: SeCreateGlobalPrivilege	4644	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

rfusclient.exe

pid	process
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe

Suspicious use of SendNotifyMessage 10 IoCs

Processes:

rfusclient.exe

pid	process
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe
4692	rfusclient.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4852	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4780	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4224	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe
4032	rutserv.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Електронний план евакуації.exemsiexec.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 2284 wrote to memory of 4644	2284	Електронний план евакуації.exe	msiexec.exe
PID 2284 wrote to memory of 4644	2284	Електронний план евакуації.exe	msiexec.exe
PID 4608 wrote to memory of 440	4608	msiexec.exe	MsiExec.exe
PID 4608 wrote to memory of 440	4608	msiexec.exe	MsiExec.exe
PID 4608 wrote to memory of 440	4608	msiexec.exe	MsiExec.exe
PID 4608 wrote to memory of 932	4608	msiexec.exe	rfusclient.exe
PID 4608 wrote to memory of 932	4608	msiexec.exe	rfusclient.exe
PID 4608 wrote to memory of 932	4608	msiexec.exe	rfusclient.exe
PID 4608 wrote to memory of 4032	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4032	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4032	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4852	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4852	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4852	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4780	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4780	4608	msiexec.exe	rutserv.exe
PID 4608 wrote to memory of 4780	4608	msiexec.exe	rutserv.exe
PID 4224 wrote to memory of 4588	4224	rutserv.exe	rfusclient.exe
PID 4224 wrote to memory of 4588	4224	rutserv.exe	rfusclient.exe
PID 4224 wrote to memory of 4588	4224	rutserv.exe	rfusclient.exe
PID 4224 wrote to memory of 4692	4224	rutserv.exe	rfusclient.exe
PID 4224 wrote to memory of 4692	4224	rutserv.exe	rfusclient.exe
PID 4224 wrote to memory of 4692	4224	rutserv.exe	rfusclient.exe
PID 4588 wrote to memory of 3320	4588	rfusclient.exe	rfusclient.exe
PID 4588 wrote to memory of 3320	4588	rfusclient.exe	rfusclient.exe
PID 4588 wrote to memory of 3320	4588	rfusclient.exe	rfusclient.exe
PID 4224 wrote to memory of 4032	4224	rutserv.exe	rutserv.exe
PID 4224 wrote to memory of 4032	4224	rutserv.exe	rutserv.exe
PID 4224 wrote to memory of 4032	4224	rutserv.exe	rutserv.exe

C:\Users\Admin\AppData\Local\Temp\Електронний план евакуації.exe
"C:\Users\Admin\AppData\Local\Temp\Електронний план евакуації.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i install.msi /qn
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9A33B6502A1B394CF36501B47B976BAE
2⤵
- Loads dropped DLL
PID:440

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\install.msi"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4852

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4780

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3320

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4692

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e574a99.rbs
Filesize
41KB

MD5
55466053b6f64ee97353dc6836c3c538

SHA1
8c6593926767b073ed3a3b3337fd52bbb886aacd

SHA256
87deb2fd3aa1d5d08b0714193c027d23b0f5f636ee98ca788230fc8b637349e3

SHA512
066828a9c1ba5775b01bc6d904244b16b9ccc8c8217d00c2b4733c7f344ef378e8725e7224fe94af5556c75b25dcd5f29156af97e5eed2c238e3893811f0f606

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Filesize
52KB

MD5
b2e6147f97dae696265a089f98ce8106

SHA1
418f20ec486b7a9368ceff183e7cebae9ba52101

SHA256
44917b2c260fea3a0f4691f6e986c25e31b3f9ff22dcd055526199b4d8a54051

SHA512
789dd02281b71fab54f42b92b5c0c76c0266c40100dbe532ad3ebbf968e8a9e674f0be57e2ffdb10eb4a6b4faa15a6a6a92907c020c6cd2990427d890d7f5026

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
1.3MB

MD5
0d577d94f46b08d3ae35523605302672

SHA1
45f7adbd262bbcd8ee0db547335a6882da2a019b

SHA256
fca62fb82162b7cf043806f2e98ef62871fb7ca170ebd69829324bc8af6add09

SHA512
27c2f09cbb1412cf7b335e136441dc4f9c1485314958cfa38b242d59209e19392bc1aafd90edc1d426ae241c1cbde4676765d80586ca24b9b008165b082ba78a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
1.3MB

MD5
b0433711581916700978618558131929

SHA1
6513c7c14f19fa37c73926fc098a9da678621e04

SHA256
26b24dcd9cb7ab8761ae7fb597704f81e2a6ede6572a247c39a969960dbba539

SHA512
a1d8bcd4b641b5e54a4435a70e19a56ecce6dc9c7d9b6fc28f7829de96d139c9cfd10f35f096529f8d33583bea8ffe1b6c2636f2710d9d01f1a7513f77db8589

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
38KB

MD5
50792871298e921a838dadbe62accaea

SHA1
21444ca261c823ac631f0aaf32ef0c1ebf88bb66

SHA256
d6918fc9e390533fc991d25f03d0a92be511db08a6014bda2d14c4e38d7b21a3

SHA512
336ba55fe7ba03b364e8cb2ac930c37d533277531eeee0f4b1a720382167ea615a66cc94e6b772f04d8a8095f63c985cdb06b3faf87352a3d0dd9730b63c1dc9

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
10.3MB

MD5
7f84d6a193ae8c0854e914c2a84d2eb6

SHA1
bd23df0bea3ad2665b52407b1a8303ee7e5ddc32

SHA256
c8f16c156f7690e2b357bda960362708fe2a3b52d35d7aa54cbde6e87b47d440

SHA512
f0487acbe5931e35f1cf0fe3075ffe52dd33de79e24fdcee3fed036989040b5d1655b1625f47f26b16daad433725998b97324423bb6d91ef4db01ad38213c0fe

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
7.6MB

MD5
683ce15320e5bd9f8032a7bdab94e6a0

SHA1
31d69e623609592b53c9559f22816a522c9a167f

SHA256
7dd778fd4949377d5a30378f1ca1b6f655bc2aaaab0340ecb9bda4f861375923

SHA512
8a56d197049b03fc94ece85c62bc175078764bc904795ff4114c0b17a7c1d40e86323c1acb250f000235c7b78054c7aa9f4510dc63f54dff43fdba567aa2f373

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
10.4MB

MD5
6aae165f3b1575db887a0370cfc80083

SHA1
18bc72662b4366035932719ef131417aacf9c184

SHA256
0c89262a283c80121ba1176345b230d0ade61cfcf682b92e555a48206fb4074a

SHA512
666f1a5c6b0c7a5315d70eb0d75da6232105e5673b44f6137be4b10377b8d07c21720d05360cc653f543657478b08eee1d95db5fb1cb8d82d5c2a0f2ff68e7c7

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
11.1MB

MD5
a29fa831a2c73f69af8aa55e46915223

SHA1
58b4c8b3b4c776803ee837981114ea40dffb7ca7

SHA256
c4fcc8b8be2a2b9e4bbaacbfef1ab06dccb70acc9fbd903e3c8a9656dbf15c11

SHA512
48632c6b732d9f35a8fec914007dc1bc5d33d9a033f31faa7ba3819c916e76d502b0ceee96faea7f28a34b39139a6b29c86a7dc7ccade6f58815713b32508af8

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
8.8MB

MD5
db71b16625935e70905423a8fa2ba6cf

SHA1
a8c6acbc79fffd47314aa4599d22f7f0af958fa6

SHA256
f2035c546a0ba5b05405832b8b4d213d3b3586240bf149543d18c33e95daa480

SHA512
0e93aa2efede6a487b9737efb12235e4a99f665e06e9c988ce1bdd1729b57e7826737d71e4c6b7170a6bdfb72754b53c9c36d14bd6a1117a30e609a06312b515

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
10.0MB

MD5
18ae7cd4c728aac1d17d3f25057fd0da

SHA1
55c5251ac20e5eaf7e220b01cf7ca8237713b3aa

SHA256
41227ae6d0c1190d991ea96ae531bc0a2ce24d6b33f51ccea4f7521b7a6a7f49

SHA512
bb30764c5cad6a5efc225238cd91ab56c626a52c3a0dff35193eac65a6f99edb359f91f12032187e6e3254cfa5c24ab0b810bdf59177e8749b1bc76d83a6a97a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
15.2MB

MD5
ba20a0712673c6f3b44805ef6ebf679c

SHA1
dc34d480b6fd60dd92ac094013375114518da065

SHA256
12fbab95c470335bd718380a63578aa222d5893dd5c7344c605c56103155f3b7

SHA512
dc6e5b32914e6ad51317d5db1d8166127eb32d3f552d3f4f6abfd0a023dd48dab971e4ffc6d431def0dacc40412705906945867754d9e39a0c931329630a5d0a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
2.8MB

MD5
49e180607e83d5851545b49eba2afbbe

SHA1
3bda5a5191cb43be2ffc523e8918a45774dc764a

SHA256
99396f02a0d6ef69bf4570485e7e7fc88ad7ca99adb9e3f092297d1e680f3c33

SHA512
415cd0d8acaf40d791d34fd1b74dd820a663a9e179e6aa9d4f57555d5bf82e9afa76cb37205dda920804258b5c1f2d686f08e0a14de3bd5a500987dcfbf93279

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
2.6MB

MD5
36f24acec2be2803622064c82dfe59a9

SHA1
ed818299d9298ef174e62bcf1abe9cffbfc8e304

SHA256
60dcd9f113c0561d2993bac6d73869da3147843d1f66f1ac6a50363c1a4a0596

SHA512
7e06ea915e82c2e6ed0e5c315b45fc9ee06df75dd53bf5f3d4710c27b60d306ca3a83bad06644918d09ac096f0de8988ede6e7aa9b081ea68115ac7172dccda9

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
338KB

MD5
74f9696be4b46f04a1263c3181405c35

SHA1
cf66b349beaa2bc25ed5807763e32018e4304c7b

SHA256
d6e8bee1a9476ed3be229f4be81cc1154f1ed425e50e74fd1abcd76c56ea062c

SHA512
f122e00b795476809994733028346d82945566ce4c2be26444f02e077658ccb1ba0f3fe221cef37837941054fe4b3b54b3f9a74861f890e56544d1453823fd68

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
106KB

MD5
4974e730a21f8205a7f109548a85f4c0

SHA1
60b874b01cd433b02348c8eac986a98366a84a4f

SHA256
395993e16bc462c1f35fa28b57dda60d7dbed08628145e7f6c9c4a694d60f64d

SHA512
1864bd70bd72e43cef34b1d7d5a8db257249c4e8946c5d9f1115d9d6863ed672a1e90d2bcc6c327686c5c2e35fd4989e686f1693eb0d8848c730eca2fdf4537c

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Filesize
380KB

MD5
c14000f68306f1cf0ec799df9568ae01

SHA1
788d8d7a0ba86ba6c7ef4f7ae50cdc65ddb348ff

SHA256
53b040341ce80f246c8437a99df5252a48801e2154eb94dc50af54a75d8d85ac

SHA512
2d4769949832794ce310474f843b696ea8eeb819554ecd72c449981988a6f8fbc5155d84a97d8a4c015348b3dfe6708f88c64b257d4a4d0d4a03dd068dda4113

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Filesize
1.6MB

MD5
30448db0aac5ac16d7ad789011bf8d20

SHA1
457a43f6d2a0120c138dd9d57bcb64b21f84d9d7

SHA256
d781088435617ca1facf74c1304f82afcb388813a75c8cb32213541d35b21832

SHA512
300e3ae2ac133e2494c449354582ad9be51731d3e92d161b998db14262cc08436eeddb2b73a2f47cb4d1245348055f19e02721638a64a0630f513d4919b359dd

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Filesize
260KB

MD5
5e8673834662ac42b8363e19bc719282

SHA1
bb1c1ed731830a03db47d232e748df4e4d196db9

SHA256
a64a113955ec0d89ae6ff357f9bb1063c7dd29fe5610ee516a94ac17b11172c2

SHA512
3cf558b2d3ca03aed1ef0cfe36fb7ff3fe7a3af63a4c3b0cb6cf13c58baacae17e5a01bad743affae8c4f5b9f5425dd4a97755aca2ded99e70d782f699a9e225

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Filesize
365KB

MD5
95d30b282132fb591fd5fdd94e52af05

SHA1
eb7abe2f02c19ee41e4efc2506337288141d70ed

SHA256
e6c04dc8359b2c76f765fce37ec123d33acbc5ce93e60022ba88eb7c867ac3f6

SHA512
9e4ea23519d243d6d3ae93d2501f05f35aa1cc6264adb8f180f8a255bd35fb7996e110ac0ec7960fa0b93062be45eb0c0922d9597e76ee8180781cc5c9a9c792

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Filesize
860KB

MD5
a663e7ef3f3cd7a1d4790b4ebf491c27

SHA1
bfe086e653d0bc8d20acae61990ba4fa33f2a1f7

SHA256
8b1f95d7c0fdf25a6278347afda2f5ac4c86045c7fc530a330be885d8a87ea68

SHA512
e78460c287646f509a50b878a34392546e01803a46c389e942073013a8292e3653713f2b6067842ecccb09b7cdc13d1d9fff76065aa61910fc3cebe6a1c20c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.msi
Filesize
21.6MB

MD5
f54fd78880d87f1021cefcdafb516ff8

SHA1
4b46b0ea729abf629899bd2d74149b524b9767a5

SHA256
06956bb4eee98f34f035af11666459b2f9fc5f7485b2cf16f6afb17bfa15a061

SHA512
9b25552a6d91e4db3b7a9f04896810f0a77d29bc86a7b7c2cda72bc50a5326c567d12b2075f95ea9dc92510989a2ae16f57a9e3003de846041f7e6dd244e06ea

Download Submit
C:\Windows\Installer\MSI4D16.tmp
Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
memory/932-96-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/932-94-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/932-92-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/3320-184-0x0000000001470000-0x0000000001471000-memory.dmp

Filesize
4KB

Download
memory/3320-185-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/3320-186-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4032-100-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/4032-206-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4032-209-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4032-214-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4032-111-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4032-110-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-225-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-181-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/4224-152-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/4224-154-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/4224-153-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/4224-280-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-156-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/4224-149-0x00000000062B0000-0x00000000062B1000-memory.dmp

Filesize
4KB

Download
memory/4224-146-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/4224-158-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/4224-157-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4224-160-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

Filesize
4KB

Download
memory/4224-161-0x0000000007130000-0x0000000007131000-memory.dmp

Filesize
4KB

Download
memory/4224-159-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/4224-220-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-276-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-229-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-233-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-237-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-145-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/4224-271-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-267-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-180-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/4224-221-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/4224-182-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/4224-144-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/4224-140-0x0000000003F80000-0x0000000003F81000-memory.dmp

Filesize
4KB

Download
memory/4224-143-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/4224-187-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-241-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-263-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-259-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-192-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-255-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-196-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-249-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-200-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-245-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4224-133-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/4224-205-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4588-188-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4588-167-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/4588-168-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/4588-169-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/4588-162-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/4692-174-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/4692-179-0x0000000006730000-0x0000000006731000-memory.dmp

Filesize
4KB

Download
memory/4692-278-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-227-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-163-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/4692-231-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-211-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-235-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-273-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-239-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-173-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/4692-243-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-202-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-247-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-198-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-251-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-194-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-257-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-190-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/4692-261-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-189-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-265-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-223-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4692-269-0x0000000000140000-0x0000000000C5D000-memory.dmp

Filesize
11.1MB

Download
memory/4780-129-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/4780-155-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4852-117-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4852-116-0x0000000000620000-0x0000000001B10000-memory.dmp

Filesize
20.9MB

Download
memory/4852-113-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download