rurat | eb41f9ce5d810092148309af2f932db5b938c57c9c2b8a5a5078e6cb45349b7b

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

21.8MB
MD5

04d54700f8274d32b60222bc1497ebf0
SHA1

1150c1a0e45c6ee5c671a5907c8f057ece4bc1e5
SHA256

eb41f9ce5d810092148309af2f932db5b938c57c9c2b8a5a5078e6cb45349b7b
SHA512

879667c69733b6edad159a5882b4f3a4a8f968c030b4a868742e591b61a5ff476b05f910bc3f2d64583f0bf385aaba6df4ee2ddbd91fbef0f9d74e8d05175fe1
SSDEEP

393216:/LfK/LS1/Lgntpvw2D3r4qg8RvPNJrHS7i9CPq7E0YIpUx9gZjpWQma9BKyIo9Xt:zIQy+qRvPn2+CP+EUE9vFo9L5

Score

10^/10

rurat backdoor trojan

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exerfusclient.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 8 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid process

1792 rfusclient.exe
3888 rutserv.exe
4536 rutserv.exe
2280 rutserv.exe
4264 rutserv.exe
1288 rfusclient.exe
2036 rfusclient.exe
3772 rfusclient.exe
Loads dropped DLL 9 IoCs

Processes:

MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid process

2908 MsiExec.exe
3888 rutserv.exe
3888 rutserv.exe
4536 rutserv.exe
4536 rutserv.exe
2280 rutserv.exe
2280 rutserv.exe
4264 rutserv.exe
4264 rutserv.exe

pid	process
2908	MsiExec.exe
3888	rutserv.exe
3888	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

tmp.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	tmp.exe
File opened (read-only)	\??\H:	tmp.exe
File opened (read-only)	\??\J:	tmp.exe
File opened (read-only)	\??\S:	tmp.exe
File opened (read-only)	\??\X:	tmp.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	tmp.exe
File opened (read-only)	\??\P:	tmp.exe
File opened (read-only)	\??\V:	tmp.exe
File opened (read-only)	\??\Z:	tmp.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	tmp.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	tmp.exe
File opened (read-only)	\??\K:	tmp.exe
File opened (read-only)	\??\T:	tmp.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	tmp.exe
File opened (read-only)	\??\W:	tmp.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	tmp.exe
File opened (read-only)	\??\N:	tmp.exe
File opened (read-only)	\??\Y:	tmp.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	tmp.exe
File opened (read-only)	\??\I:	tmp.exe
File opened (read-only)	\??\O:	tmp.exe
File opened (read-only)	\??\R:	tmp.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	tmp.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 58 IoCs

Processes:

rutserv.exemsiexec.exetmp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2024-04.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host	tmp.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2024-04.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e57a378.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a374.msi	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA922.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e57a374.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA79A.tmp	msiexec.exe

Kills process with taskkill 23 IoCs

evasion

Processes:

taskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXE

pid	process
3664	taskkill.EXE
3984	taskkill.EXE
3372	taskkill.EXE
2088	taskkill.EXE
3984	taskkill.EXE
552	taskkill.EXE
3932	taskkill.EXE
3800	taskkill.EXE
4592	taskkill.EXE
5092	taskkill.EXE
428	taskkill.EXE
4008	taskkill.EXE
2208	taskkill.EXE
920	taskkill.EXE
2756	taskkill.EXE
640	taskkill.EXE
556	taskkill.EXE
3872	taskkill.EXE
1284	taskkill.EXE
1228	taskkill.EXE
1676	taskkill.EXE
2308	taskkill.EXE
4500	taskkill.EXE

Modifies data under HKEY_USERS 47 IoCs

Processes:

rutserv.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\PackageName = "RUT.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\PackageCode = "44DE303A322600D4C9BD766C631B960B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\ProductIcon = "C:\\Windows\\Installer\\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\AuthorizedLUAApp = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2BA10AC219E0CF4DA25D216B00E1DFC\RMS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Version = "117506055"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2BA10AC219E0CF4DA25D216B00E1DFC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2BA10AC219E0CF4DA25D216B00E1DFC\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rfusclient.exerutserv.exerutserv.exerutserv.exetaskkill.EXErutserv.exerfusclient.exerfusclient.exetaskkill.EXEtaskkill.EXErfusclient.exetaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXEtaskkill.EXE

pid	process
1792	rfusclient.exe
1792	rfusclient.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
3984	taskkill.EXE
3984	taskkill.EXE
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
1288	rfusclient.exe
2036	rfusclient.exe
1288	rfusclient.exe
2036	rfusclient.exe
1288	rfusclient.exe
1288	rfusclient.exe
2208	taskkill.EXE
2208	taskkill.EXE
2308	taskkill.EXE
2308	taskkill.EXE
3772	rfusclient.exe
3772	rfusclient.exe
552	taskkill.EXE
552	taskkill.EXE
920	taskkill.EXE
920	taskkill.EXE
2756	taskkill.EXE
2756	taskkill.EXE
3800	taskkill.EXE
3800	taskkill.EXE
4592	taskkill.EXE
4592	taskkill.EXE
1284	taskkill.EXE
1284	taskkill.EXE
5092	taskkill.EXE
5092	taskkill.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exetmp.exe

description	pid	process
Token: SeSecurityPrivilege	1744	msiexec.exe
Token: SeCreateTokenPrivilege	4384	tmp.exe
Token: SeAssignPrimaryTokenPrivilege	4384	tmp.exe
Token: SeLockMemoryPrivilege	4384	tmp.exe
Token: SeIncreaseQuotaPrivilege	4384	tmp.exe
Token: SeMachineAccountPrivilege	4384	tmp.exe
Token: SeTcbPrivilege	4384	tmp.exe
Token: SeSecurityPrivilege	4384	tmp.exe
Token: SeTakeOwnershipPrivilege	4384	tmp.exe
Token: SeLoadDriverPrivilege	4384	tmp.exe
Token: SeSystemProfilePrivilege	4384	tmp.exe
Token: SeSystemtimePrivilege	4384	tmp.exe
Token: SeProfSingleProcessPrivilege	4384	tmp.exe
Token: SeIncBasePriorityPrivilege	4384	tmp.exe
Token: SeCreatePagefilePrivilege	4384	tmp.exe
Token: SeCreatePermanentPrivilege	4384	tmp.exe
Token: SeBackupPrivilege	4384	tmp.exe
Token: SeRestorePrivilege	4384	tmp.exe
Token: SeShutdownPrivilege	4384	tmp.exe
Token: SeDebugPrivilege	4384	tmp.exe
Token: SeAuditPrivilege	4384	tmp.exe
Token: SeSystemEnvironmentPrivilege	4384	tmp.exe
Token: SeChangeNotifyPrivilege	4384	tmp.exe
Token: SeRemoteShutdownPrivilege	4384	tmp.exe
Token: SeUndockPrivilege	4384	tmp.exe
Token: SeSyncAgentPrivilege	4384	tmp.exe
Token: SeEnableDelegationPrivilege	4384	tmp.exe
Token: SeManageVolumePrivilege	4384	tmp.exe
Token: SeImpersonatePrivilege	4384	tmp.exe
Token: SeCreateGlobalPrivilege	4384	tmp.exe
Token: SeShutdownPrivilege	4384	tmp.exe
Token: SeIncreaseQuotaPrivilege	4384	tmp.exe
Token: SeCreateTokenPrivilege	4384	tmp.exe
Token: SeAssignPrimaryTokenPrivilege	4384	tmp.exe
Token: SeLockMemoryPrivilege	4384	tmp.exe
Token: SeIncreaseQuotaPrivilege	4384	tmp.exe
Token: SeMachineAccountPrivilege	4384	tmp.exe
Token: SeTcbPrivilege	4384	tmp.exe
Token: SeSecurityPrivilege	4384	tmp.exe
Token: SeTakeOwnershipPrivilege	4384	tmp.exe
Token: SeLoadDriverPrivilege	4384	tmp.exe
Token: SeSystemProfilePrivilege	4384	tmp.exe
Token: SeSystemtimePrivilege	4384	tmp.exe
Token: SeProfSingleProcessPrivilege	4384	tmp.exe
Token: SeIncBasePriorityPrivilege	4384	tmp.exe
Token: SeCreatePagefilePrivilege	4384	tmp.exe
Token: SeCreatePermanentPrivilege	4384	tmp.exe
Token: SeBackupPrivilege	4384	tmp.exe
Token: SeRestorePrivilege	4384	tmp.exe
Token: SeShutdownPrivilege	4384	tmp.exe
Token: SeDebugPrivilege	4384	tmp.exe
Token: SeAuditPrivilege	4384	tmp.exe
Token: SeSystemEnvironmentPrivilege	4384	tmp.exe
Token: SeChangeNotifyPrivilege	4384	tmp.exe
Token: SeRemoteShutdownPrivilege	4384	tmp.exe
Token: SeUndockPrivilege	4384	tmp.exe
Token: SeSyncAgentPrivilege	4384	tmp.exe
Token: SeEnableDelegationPrivilege	4384	tmp.exe
Token: SeManageVolumePrivilege	4384	tmp.exe
Token: SeImpersonatePrivilege	4384	tmp.exe
Token: SeCreateGlobalPrivilege	4384	tmp.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rfusclient.exe

pid process

3772 rfusclient.exe
3772 rfusclient.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

rfusclient.exe

pid process

3772 rfusclient.exe
3772 rfusclient.exe

pid	process
3772	rfusclient.exe
3772	rfusclient.exe

pid	process
3772	rfusclient.exe
3772	rfusclient.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
3888	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
4536	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
2280	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe
4264	rutserv.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

msiexec.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 1744 wrote to memory of 2908	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2908	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2908	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 1792	1744	msiexec.exe	rfusclient.exe
PID 1744 wrote to memory of 1792	1744	msiexec.exe	rfusclient.exe
PID 1744 wrote to memory of 1792	1744	msiexec.exe	rfusclient.exe
PID 1744 wrote to memory of 3888	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 3888	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 3888	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 4536	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 4536	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 4536	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 2280	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 2280	1744	msiexec.exe	rutserv.exe
PID 1744 wrote to memory of 2280	1744	msiexec.exe	rutserv.exe
PID 4264 wrote to memory of 1288	4264	rutserv.exe	rfusclient.exe
PID 4264 wrote to memory of 1288	4264	rutserv.exe	rfusclient.exe
PID 4264 wrote to memory of 1288	4264	rutserv.exe	rfusclient.exe
PID 4264 wrote to memory of 2036	4264	rutserv.exe	rfusclient.exe
PID 4264 wrote to memory of 2036	4264	rutserv.exe	rfusclient.exe
PID 4264 wrote to memory of 2036	4264	rutserv.exe	rfusclient.exe
PID 1288 wrote to memory of 3772	1288	rfusclient.exe	rfusclient.exe
PID 1288 wrote to memory of 3772	1288	rfusclient.exe	rfusclient.exe
PID 1288 wrote to memory of 3772	1288	rfusclient.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C2AD87F1249A96D0EA55C0043C0E41D6
2⤵
- Loads dropped DLL
PID:2908

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT.msi"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3888

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2280

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:3984

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3772

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:2208

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:552

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:3800

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:1284

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
- Suspicious behavior: EnumeratesProcesses
PID:5092

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:428

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:4008

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:640

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:4500

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:3932

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:3664

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:3984

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:3372

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:556

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:1228

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:3872

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:2088

C:\Windows\system32\taskkill.EXE
C:\Windows\system32\taskkill.EXE /fi "USERNAME ne NT AUTHORITY\SYSTEM" /im rfusclient.exe /f
1⤵
- Kills process with taskkill
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a377.rbs
Filesize
31KB

MD5
55c9c9e553d735e00227e55ba6185188

SHA1
a85c85b1a97f586111292ac7266c62975d1efe7f

SHA256
6e17afcc2bbd932f24c4ca9b3a326c9544dacf620e81fa0e34bf8eee3bbe3d65

SHA512
74191ddaecd48030917dbfb68e3680877c486fc4fed9a7e5efd9b4068c4b2e7bb4ce98eb0a837f125594fc6edbcf92603c4c9c45a154ef4e91894b506a03de5a

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Filesize
51KB

MD5
ca8a4346b37cdd0220792885c5937b30

SHA1
eef05f4b7fb5f8aabfb93d10a6451cc77b489864

SHA256
ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745

SHA512
c286b0fa9d24a85fe63d3a3d801f135d12409736742c4fc16ba1dc15529df136577dc8975736146437dd56467576fdedb4ac50cf05ab054547504f3dc5ca0c35

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
Filesize
1.3MB

MD5
d9871a6ba02aacf3d51e6c168d9c6066

SHA1
42012a0116a9e8aed16c7298bd43cb1206a0f0cd

SHA256
7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95

SHA512
ae9118dac893097cd0e388ce45ff76c26b99b1cc9aea59547cc1dedf00bfbaf575f3d05317fac2f3f8b5c97896f6080bea9a90425333dbf02013eb01a002e43f

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Filesize
10.4MB

MD5
68a63168426f28bc06c7c06eac6f09d5

SHA1
ae947e6b9b3322f7837396f606e64b0f372fa78c

SHA256
02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40

SHA512
7beabe39242237dd19606392bb7970f2eea0e8d467ee42a10e8ad3608e9b6a6aa060e4cd112fce425677dcc33ea062c6224574599351e81060c348409eeb11a6

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Filesize
19.8MB

MD5
31c0bafc3f6e6c7322a7a32ac1bd87da

SHA1
42fd1a41e1eef5998de674ec068c702f1ee3b4f3

SHA256
f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5

SHA512
ab8dcda75a2e9c4d7dfcc23e76b3ca76b4ec5f1fbf24007bf0e9707de17461c5016ec9005dae3f62e34f586452aa145871d371536572365b35bf33b43a8d24ab

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
Filesize
337KB

MD5
fe6d8feaeae983513e0a9a223604041b

SHA1
efa54892735d331a24b707068040e5a697455cee

SHA256
af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0

SHA512
a78b1643c9ea02004aabefc9c72d418ee3292edb63a90002608ac02ad4e1a92d86b0fc95e66d6d4b49404c1fc75845d0e6262821b6052ab037b4542fcaf2047d

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Filesize
380KB

MD5
41acd8b6d9d80a61f2f686850e3d676a

SHA1
38428a08915cf72dd2eca25b3d87613d9aa027dd

SHA256
36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7

SHA512
d174638965ec781cbcb2927ceafb295c3176dc78da8938467faca3e512a42fe71a9dc1070f23e1c95f0b7c157fff3b00a8b572c39e4670713564f1310360ed23

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Filesize
1.6MB

MD5
2ac39d6990170ca37a735f2f15f970e8

SHA1
8148a9cdc6b3fe6492281ebad79636433a6064ab

SHA256
0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa

SHA512
7e30fde909d5f8efd6c2e40e125525697267273163ac35cf53561a2bd32e5dad8e4fba32905f53e422c9c73b8ad9a0c151f8d36042c5f156b50bf42dc21a9cee

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Filesize
260KB

MD5
8a683f90a78778fba037565588a6f752

SHA1
011939c1fa7b73272db340c32386a13e140adc6a

SHA256
bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d

SHA512
9280fbb121f8b94f57560d1be3bcfe5e7c308d54dac278f13ea6c00256444fb9f17f543dd0d32c9844460818c1a50d83b26ce51c79698e9ca7a304652a3f5ea9

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Filesize
365KB

MD5
c9d412c1d30abb9d61151a10371f4140

SHA1
87120faa6b859f5e23f7344f9547b2fc228af15b

SHA256
f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e

SHA512
1c020afa89cdae55f4dcb80a455dc1b352f40455142f3947ed29c3e3d51fbd465b6e0ea16cd103186c252783a3f2a7f7c417e4df5727d9b2db511b650308face

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Filesize
860KB

MD5
a59f69797c42324540e26c7c7998c18c

SHA1
7f7bc5bc62a8744f87a7d2e30cc6dd74c72e19b4

SHA256
83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1

SHA512
837f244e6b70658974506ac35bd3ee2d413b89fe4b26e75f4a61cc7bec63e999c9c2cffb690ad567f74962bab13f2f5471300cd0e0cfe61bb1084072cb55c38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT.msi
Filesize
21.5MB

MD5
80e61e367f4eaafff79b82849ab40ccd

SHA1
70aa7a8ca5f774c3cbee55277eafdfafdf4c9155

SHA256
346926866d193881de8a86bc4793194195f7751d2d3fe6b02fed5e9199890795

SHA512
913152b6b32c314ce9c587f6991cd9b284859b8a347dfdef63050c1db5eaf536159b042c1670bafe2a9f35350059d7c136e6a1b760b0f7688b8b660ff9b2c2bc

Download Submit
C:\Windows\Installer\MSIA79A.tmp
Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
memory/1288-149-0x0000000000400000-0x0000000000F17000-memory.dmp

Filesize
11.1MB

Download
memory/1792-97-0x0000000000400000-0x0000000000F17000-memory.dmp

Filesize
11.1MB

Download
memory/2036-143-0x0000000000400000-0x0000000000F17000-memory.dmp

Filesize
11.1MB

Download
memory/2280-142-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/3772-150-0x0000000000400000-0x0000000000F17000-memory.dmp

Filesize
11.1MB

Download
memory/3888-110-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-167-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-156-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-178-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-175-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-152-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-154-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-148-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-159-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-170-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-173-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4264-163-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download
memory/4384-126-0x0000000000450000-0x00000000019E6000-memory.dmp

Filesize
21.6MB

Download
memory/4384-8-0x0000000000450000-0x00000000019E6000-memory.dmp

Filesize
21.6MB

Download
memory/4536-114-0x0000000000400000-0x0000000001896000-memory.dmp

Filesize
20.6MB

Download