rurat | hxxp://www[.]remoteutilities[.]com/download/host-7[.]2[.]2[.]0[.]exe

Analysis

max time kernel
393s
max time network
393s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.remoteutilities.com/download/host-7.2.2.0.exe

Score

10^/10

rurat backdoor discovery trojan upx

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exerutserv.exerutserv.exehost-7.2.2.0.exerfusclient.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	host-7.2.2.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 13 IoCs

Processes:

host-7.2.2.0.exerfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exehost-7.2.2.0.exerutserv.exerutserv.exe

pid	process
2252	host-7.2.2.0.exe
5692	rfusclient.exe
5640	rutserv.exe
5552	rutserv.exe
5780	rutserv.exe
5956	rutserv.exe
6084	rutserv.exe
4964	rfusclient.exe
3472	rfusclient.exe
6024	rfusclient.exe
2684	host-7.2.2.0.exe
5232	rutserv.exe
5772	rutserv.exe

Loads dropped DLL 15 IoCs

Processes:

MsiExec.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
5140	MsiExec.exe
5640	rutserv.exe
5640	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
5232	rutserv.exe
5232	rutserv.exe
5772	rutserv.exe
5772	rutserv.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\host-7.yS5CCl-h.2.2.0.exe.part	upx
C:\Users\Admin\Downloads\host-7.2.2.0.exe	upx
behavioral1/memory/2252-98-0x0000000000400000-0x00000000033B8000-memory.dmp	upx
behavioral1/memory/2252-127-0x0000000000400000-0x00000000033B8000-memory.dmp	upx
behavioral1/memory/2252-367-0x0000000000400000-0x00000000033B8000-memory.dmp	upx
behavioral1/memory/2684-411-0x0000000000400000-0x00000000033B8000-memory.dmp	upx
behavioral1/memory/2684-422-0x0000000000400000-0x00000000033B8000-memory.dmp	upx

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

66 736 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
66	736	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 8 IoCs

Processes:

rutserv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe

Drops file in Program Files directory 55 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe

Drops file in Windows directory 18 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSID6C8.tmp	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d486.msi	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\e57d488.msi	msiexec.exe
File created	C:\Windows\Installer\e57d486.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9712a8ab103c3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9712a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9712a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9712a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9712a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 48 IoCs

Processes:

rutserv.exemsiexec.exerutserv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeexplorer.exefirefox.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADD21FF3AD83F6644B3E7657CAFE5583\RMS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Mode = "4"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\ProductIcon = "C:\\Windows\\Installer\\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\FFlags = "18874433"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\PackageName = "installer.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\ADD21FF3AD83F6644B3E7657CAFE5583	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Version = "117571586"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\PackageCode = "18BC6BFBD2A8CF147A73C58FBE730039"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e007180000000000000000000006abe817b2bce7646a29eeb907a5126c50000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADD21FF3AD83F6644B3E7657CAFE5583\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\host-7.2.2.0.exe:Zone.Identifier firefox.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

5644 explorer.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\host-7.2.2.0.exe:Zone.Identifier	firefox.exe

pid	process
5644	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

host-7.2.2.0.exerfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exetaskmgr.exe

pid	process
2252	host-7.2.2.0.exe
2252	host-7.2.2.0.exe
2252	host-7.2.2.0.exe
2252	host-7.2.2.0.exe
5692	rfusclient.exe
5692	rfusclient.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
3472	rfusclient.exe
3472	rfusclient.exe
4964	rfusclient.exe
4964	rfusclient.exe
4964	rfusclient.exe
4964	rfusclient.exe
6024	rfusclient.exe
6024	rfusclient.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exeexplorer.exe

pid process

1908 taskmgr.exe
5644 explorer.exe

pid	process
1908	taskmgr.exe
5644	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	4736	firefox.exe
Token: SeDebugPrivilege	4736	firefox.exe
Token: SeShutdownPrivilege	736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	736	msiexec.exe
Token: SeSecurityPrivilege	3316	msiexec.exe
Token: SeCreateTokenPrivilege	736	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	736	msiexec.exe
Token: SeLockMemoryPrivilege	736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	736	msiexec.exe
Token: SeMachineAccountPrivilege	736	msiexec.exe
Token: SeTcbPrivilege	736	msiexec.exe
Token: SeSecurityPrivilege	736	msiexec.exe
Token: SeTakeOwnershipPrivilege	736	msiexec.exe
Token: SeLoadDriverPrivilege	736	msiexec.exe
Token: SeSystemProfilePrivilege	736	msiexec.exe
Token: SeSystemtimePrivilege	736	msiexec.exe
Token: SeProfSingleProcessPrivilege	736	msiexec.exe
Token: SeIncBasePriorityPrivilege	736	msiexec.exe
Token: SeCreatePagefilePrivilege	736	msiexec.exe
Token: SeCreatePermanentPrivilege	736	msiexec.exe
Token: SeBackupPrivilege	736	msiexec.exe
Token: SeRestorePrivilege	736	msiexec.exe
Token: SeShutdownPrivilege	736	msiexec.exe
Token: SeDebugPrivilege	736	msiexec.exe
Token: SeAuditPrivilege	736	msiexec.exe
Token: SeSystemEnvironmentPrivilege	736	msiexec.exe
Token: SeChangeNotifyPrivilege	736	msiexec.exe
Token: SeRemoteShutdownPrivilege	736	msiexec.exe
Token: SeUndockPrivilege	736	msiexec.exe
Token: SeSyncAgentPrivilege	736	msiexec.exe
Token: SeEnableDelegationPrivilege	736	msiexec.exe
Token: SeManageVolumePrivilege	736	msiexec.exe
Token: SeImpersonatePrivilege	736	msiexec.exe
Token: SeCreateGlobalPrivilege	736	msiexec.exe
Token: SeCreateTokenPrivilege	736	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	736	msiexec.exe
Token: SeLockMemoryPrivilege	736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	736	msiexec.exe
Token: SeMachineAccountPrivilege	736	msiexec.exe
Token: SeTcbPrivilege	736	msiexec.exe
Token: SeSecurityPrivilege	736	msiexec.exe
Token: SeTakeOwnershipPrivilege	736	msiexec.exe
Token: SeLoadDriverPrivilege	736	msiexec.exe
Token: SeSystemProfilePrivilege	736	msiexec.exe
Token: SeSystemtimePrivilege	736	msiexec.exe
Token: SeProfSingleProcessPrivilege	736	msiexec.exe
Token: SeIncBasePriorityPrivilege	736	msiexec.exe
Token: SeCreatePagefilePrivilege	736	msiexec.exe
Token: SeCreatePermanentPrivilege	736	msiexec.exe
Token: SeBackupPrivilege	736	msiexec.exe
Token: SeRestorePrivilege	736	msiexec.exe
Token: SeShutdownPrivilege	736	msiexec.exe
Token: SeDebugPrivilege	736	msiexec.exe
Token: SeAuditPrivilege	736	msiexec.exe
Token: SeSystemEnvironmentPrivilege	736	msiexec.exe
Token: SeChangeNotifyPrivilege	736	msiexec.exe
Token: SeRemoteShutdownPrivilege	736	msiexec.exe
Token: SeUndockPrivilege	736	msiexec.exe
Token: SeSyncAgentPrivilege	736	msiexec.exe
Token: SeEnableDelegationPrivilege	736	msiexec.exe
Token: SeManageVolumePrivilege	736	msiexec.exe
Token: SeImpersonatePrivilege	736	msiexec.exe
Token: SeCreateGlobalPrivilege	736	msiexec.exe
Token: SeCreateTokenPrivilege	736	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exemsiexec.exerfusclient.exetaskmgr.exe

pid	process
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
736	msiexec.exe
3472	rfusclient.exe
3472	rfusclient.exe
736	msiexec.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exerfusclient.exetaskmgr.exe

pid	process
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
3472	rfusclient.exe
3472	rfusclient.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe
1908	taskmgr.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

firefox.exehost-7.2.2.0.exerutserv.exerutserv.exerutserv.exerutserv.exerutserv.exehost-7.2.2.0.exerutserv.exerutserv.exe

pid	process
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
4736	firefox.exe
2252	host-7.2.2.0.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5640	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5552	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5956	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
5780	rutserv.exe
5956	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
6084	rutserv.exe
2684	host-7.2.2.0.exe
5232	rutserv.exe
5232	rutserv.exe
5232	rutserv.exe
5232	rutserv.exe
5232	rutserv.exe
5772	rutserv.exe
5772	rutserv.exe
5772	rutserv.exe
5772	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 3728 wrote to memory of 4736	3728	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 1600	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe
PID 4736 wrote to memory of 2828	4736	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://www.remoteutilities.com/download/host-7.2.2.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://www.remoteutilities.com/download/host-7.2.2.0.exe
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.0.2010153966\10071710" -parentBuildID 20230214051806 -prefsHandle 1780 -prefMapHandle 1512 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b28dd569-a741-4fb2-a5a1-37b8e0a325fa} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 1860 293e3924058 gpu
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.1.199180753\1899142463" -parentBuildID 20230214051806 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35fb574a-e97b-4274-b46f-6e51e5a55424} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 2456 293cf688758 socket
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.2.2103450582\1755089104" -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 3020 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1320 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4af2c4c-c368-48dd-bc28-aab172a3566b} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 2948 293e3f58c58 tab
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.3.474109954\395461022" -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3948 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1320 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d38e523-9a45-44c2-a36d-b6b72fe5a4c0} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 3976 293e6b75a58 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.4.1380805476\1857314759" -childID 3 -isForBrowser -prefsHandle 5264 -prefMapHandle 5260 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 1320 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ced42969-8ee5-49f0-a722-bddae6a68a78} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 5108 293eaa30d58 tab
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.5.816497583\1631399220" -childID 4 -isForBrowser -prefsHandle 5488 -prefMapHandle 5484 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 1320 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67c8a9ef-f6b1-4918-9345-33c4c9ae9082} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 5496 293eaa30458 tab
    3⤵
    PID:1212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4736.6.549604530\1698824475" -childID 5 -isForBrowser -prefsHandle 5632 -prefMapHandle 5636 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 1320 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90ebad61-e581-4d2e-9ae4-a10e81a789b1} 4736 "\\.\pipe\gecko-crash-server-pipe.4736" 5624 293eaa30a58 tab
    3⤵
    PID:380
- - C:\Users\Admin\Downloads\host-7.2.2.0.exe
    "C:\Users\Admin\Downloads\host-7.2.2.0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2252
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{A1E7955D-65C3-4B48-9BC2-6DE268E083F7}\installer.msi"
      4⤵
      Blocklisted process makes network request
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 78EF5103BB13A16E3A96C48384B60A58 C
  2⤵
  - Loads dropped DLL
  PID:5140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6012
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{A1E7955D-65C3-4B48-9BC2-6DE268E083F7}\installer.msi"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5692
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5640
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5552
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5780
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /CONFIG /SETSECURITY
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5352

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6084
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6024
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

C:\Users\Admin\Downloads\host-7.2.2.0.exe
"C:\Users\Admin\Downloads\host-7.2.2.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5644

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3696

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /config
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d487.rbs

Filesize
15KB

MD5
835a0baddc4a4ceb09b97777b904af4c

SHA1
656072ac67a5e60acc8b9e5a86504540cbaf2046

SHA256
f037d37a9314f01c52be31a16c9b52babfadcb8348f0356f97da7a6d70306e87

SHA512
a3951c993ca1eaba2c662a94dd1aabf210e4a1bd8ddfd1f77804931ed66f458dbeacced4970b8d2d1cbc50b1e0a944f6881316cfdcd9c58f5a47d56246a74434

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\eula.rtf

Filesize
15KB

MD5
9b0e600eb09e7a86199f7ba245d1cd2b

SHA1
e3e52b3e04b08e59aae74300f7d30c3d0aa27148

SHA256
879180116b82210292648709982f405eae84b05e6f2ff324a6a5cc7cd512d3e7

SHA512
dd1622474c48ecf5c95e7585fb30b5279cf45dfc89332531758838b05f73499f536f7cadaf529aa4fa5ae0808e30a455465829db7d13f2ee2e7d9b7bd12e17e5

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll

Filesize
52KB

MD5
b2e6147f97dae696265a089f98ce8106

SHA1
418f20ec486b7a9368ceff183e7cebae9ba52101

SHA256
44917b2c260fea3a0f4691f6e986c25e31b3f9ff22dcd055526199b4d8a54051

SHA512
789dd02281b71fab54f42b92b5c0c76c0266c40100dbe532ad3ebbf968e8a9e674f0be57e2ffdb10eb4a6b4faa15a6a6a92907c020c6cd2990427d890d7f5026

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll

Filesize
1.3MB

MD5
b0433711581916700978618558131929

SHA1
6513c7c14f19fa37c73926fc098a9da678621e04

SHA256
26b24dcd9cb7ab8761ae7fb597704f81e2a6ede6572a247c39a969960dbba539

SHA512
a1d8bcd4b641b5e54a4435a70e19a56ecce6dc9c7d9b6fc28f7829de96d139c9cfd10f35f096529f8d33583bea8ffe1b6c2636f2710d9d01f1a7513f77db8589

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Filesize
10.4MB

MD5
6aae165f3b1575db887a0370cfc80083

SHA1
18bc72662b4366035932719ef131417aacf9c184

SHA256
0c89262a283c80121ba1176345b230d0ade61cfcf682b92e555a48206fb4074a

SHA512
666f1a5c6b0c7a5315d70eb0d75da6232105e5673b44f6137be4b10377b8d07c21720d05360cc653f543657478b08eee1d95db5fb1cb8d82d5c2a0f2ff68e7c7

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Filesize
20.2MB

MD5
652c2a693b333504a3879460d0af7224

SHA1
235ba3847df3f39ad445b5b912cb2fb5224d9e59

SHA256
760e2fd3e57186b597d40b996811768e6c4a28ca54685e029104fcf82f68238d

SHA512
a717e916e9d881970694856f79f0e571b95c350f0b771027188dc9b27ab99c193149d4fe0e32cb4638c840340eb1dbd7fbf7458a58985a3e5be7da3345cd86c6

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll

Filesize
338KB

MD5
74f9696be4b46f04a1263c3181405c35

SHA1
cf66b349beaa2bc25ed5807763e32018e4304c7b

SHA256
d6e8bee1a9476ed3be229f4be81cc1154f1ed425e50e74fd1abcd76c56ea062c

SHA512
f122e00b795476809994733028346d82945566ce4c2be26444f02e077658ccb1ba0f3fe221cef37837941054fe4b3b54b3f9a74861f890e56544d1453823fd68

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll

Filesize
380KB

MD5
c14000f68306f1cf0ec799df9568ae01

SHA1
788d8d7a0ba86ba6c7ef4f7ae50cdc65ddb348ff

SHA256
53b040341ce80f246c8437a99df5252a48801e2154eb94dc50af54a75d8d85ac

SHA512
2d4769949832794ce310474f843b696ea8eeb819554ecd72c449981988a6f8fbc5155d84a97d8a4c015348b3dfe6708f88c64b257d4a4d0d4a03dd068dda4113

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll

Filesize
1.6MB

MD5
30448db0aac5ac16d7ad789011bf8d20

SHA1
457a43f6d2a0120c138dd9d57bcb64b21f84d9d7

SHA256
d781088435617ca1facf74c1304f82afcb388813a75c8cb32213541d35b21832

SHA512
300e3ae2ac133e2494c449354582ad9be51731d3e92d161b998db14262cc08436eeddb2b73a2f47cb4d1245348055f19e02721638a64a0630f513d4919b359dd

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll

Filesize
260KB

MD5
5e8673834662ac42b8363e19bc719282

SHA1
bb1c1ed731830a03db47d232e748df4e4d196db9

SHA256
a64a113955ec0d89ae6ff357f9bb1063c7dd29fe5610ee516a94ac17b11172c2

SHA512
3cf558b2d3ca03aed1ef0cfe36fb7ff3fe7a3af63a4c3b0cb6cf13c58baacae17e5a01bad743affae8c4f5b9f5425dd4a97755aca2ded99e70d782f699a9e225

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll

Filesize
365KB

MD5
95d30b282132fb591fd5fdd94e52af05

SHA1
eb7abe2f02c19ee41e4efc2506337288141d70ed

SHA256
e6c04dc8359b2c76f765fce37ec123d33acbc5ce93e60022ba88eb7c867ac3f6

SHA512
9e4ea23519d243d6d3ae93d2501f05f35aa1cc6264adb8f180f8a255bd35fb7996e110ac0ec7960fa0b93062be45eb0c0922d9597e76ee8180781cc5c9a9c792

Download Submit
C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll

Filesize
860KB

MD5
a663e7ef3f3cd7a1d4790b4ebf491c27

SHA1
bfe086e653d0bc8d20acae61990ba4fa33f2a1f7

SHA256
8b1f95d7c0fdf25a6278347afda2f5ac4c86045c7fc530a330be885d8a87ea68

SHA512
e78460c287646f509a50b878a34392546e01803a46c389e942073013a8292e3653713f2b6067842ecccb09b7cdc13d1d9fff76065aa61910fc3cebe6a1c20c47

Download Submit
C:\ProgramData\Remote Utilities\install.log

Filesize
639B

MD5
3dac021ba4665f1ef02ef8191b026423

SHA1
3ea6d7c1a0e10776954030991500a694d59de7fb

SHA256
49b9079b5efb39f03427b1038b6b8e4acb1ca407aa036fcc56c6450d3ad216d9

SHA512
450826cf95a5381bcdaaf19827cbbf46445cadc64697f89127a95a504d2fc8bc98aab34c5c95331f09a29c9de393529c6197bc282845811fe9373f5a707cf743

Download Submit
C:\ProgramData\Remote Utilities\install.log

Filesize
805B

MD5
da2954153068a14c8cd1c134e784d0b6

SHA1
d269a46835a303e13d5ca68930d8a6efc50c50b8

SHA256
e08979dbadc713fa6b9557bda50e9440813edecdcc1ce1333cd79102bd61e912

SHA512
0cab426b6fdc15867f68dad16a76b12356cef359bf1f2d9d6719a32a8211f3f358c4cdae12f7c9d98e804c28b026d54cb07fe5b30ffec31ef5d283cc2301f03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Filesize
313B

MD5
6ef8922d6918f3c9db79d765294f529d

SHA1
64e0ddf8da7c5abd353caea664ebf015af9d5045

SHA256
a1025f0059c3502f27fdf8dcda6b97ed172f470139021eef904d2a5d97524de2

SHA512
6a136c189e7fa32bf943ef275152edb44598c370889e25b1100dd93c86016777c9de4f014c8657f44957e3288931a3a444fa05161ae238d7e5e04c3ade6ced2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Filesize
313B

MD5
1f1b12f76c79329455d79d60c4545331

SHA1
344f8b4eafd7e64e8042aab1add6d0aeeab7acbf

SHA256
c6e5582abc46a3bde9bcb1b60547de03ee7aa7a5e845f94a793d0d9cc928fbc0

SHA512
30f1b770ce02aaae670c30a41529960cc555f654b50524d96ad22b34e512d3bd010d26f983724ae54782a5837375397b7906d60dd216b2f878481b1a58d7dd2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Filesize
404B

MD5
34d7fcea883768f992ab510f41f8dbcd

SHA1
45ce1c4c8bd5c4df3f3f19c6f56e0ebde513e6e1

SHA256
b0525baf27f79fee3e39060905e2279ce72f2313e63ac62433d15058dcc4c4cc

SHA512
8c1fa76727eb910e35092aaa0af312774eca2eeb8984a3897ba42285fbdcacee9d69320bf4f70ace24b11e2bcdb39098f28f7dd6d4b255915e7bc09d02bed170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Filesize
408B

MD5
df0e1cafa8470a16b6f476b6b32b4faf

SHA1
4b10bc0bd4d08abf8e0cf297cb8755b9d63e2fd5

SHA256
1b594182346ab5e8f3117fdce3bf812548c9474caa98bcbbef4af68aa657e561

SHA512
1e3e3d357276dd75b2e3b64690fca81fe0d912a6da5b01e8658099d63d37af9cedb0bac4fd7ff5b7a6df7bed7de334f02c66b5c1f35e1311709d7c042e4448de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
feacc2c032311bbf50334bf60d9db124

SHA1
bad86efe2e810d8fd45db557b047d6544160e853

SHA256
317247697e17df05cd4de27735a9305e82fa7489f12244572f6738bce951e922

SHA512
b25aa94d73339f4d43c6c313fda70f3efac88fc42dca5cb9831bc5df3b6bf0393e998e17e4ea92e5314404c080ac506c85c02fb7bc144b08b7aa1fca0aac30b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\cache2\doomed\1055

Filesize
11KB

MD5
a17e2c8a23f5ed94bab39fd22e9a3c0f

SHA1
4639c2b4ffefc4eb8d01be853c8b42b6c90de162

SHA256
b8d37c45d87b4b066b0148c3ef9e069b80800eb0576e6a9e5bd104ae21285a0a

SHA512
6b538ad7f597cfe1fa29384050233fad64ad0e6efdb029a822bf625f48037f08b2d8588146cfaa4e4bd41244c6b9f50da7ef4366b8a1e8e5b9867941fb474399

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
fa386c95976ac1d95b0fe61c7f142c58

SHA1
9a6a61ed0d2bf3a6235b25d366d9b7722de4fd20

SHA256
4497cf47950e89032c26d9687978f12abf401e99bbb62c616c94f37b65b3e8b5

SHA512
aa76410d39c17882f55fdcfff2f8b616af23f3b1097f9845bdfdd3b23eddea3de6232c106aa45d4e45b1ded7df465ed34621be90ac63ef3a65ca1be73a889145

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI84DF.tmp

Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUT_{A1E7955D-65C3-4B48-9BC2-6DE268E083F7}\installer.msi

Filesize
21.6MB

MD5
3388772d8b8eb942b7ec070d2d0bd9e0

SHA1
10249c9693d3d79794ba02b6aabab8d89e7c7c4a

SHA256
c29573f6656f3b90fa4a32d61c3b697142fe3406d0fd868f32bad0e6d86d364f

SHA512
97587b4fb4fdf5a11b758f4c126b86e40891cebdbe5c26b95bb61d79430e5baa91ffab7b4c344176b53b0a5e89841477760a189a2120789f32127fb6cb0c7120

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
f3da3b7df04e154f989a6a173ab02d74

SHA1
3e8d31ae7b7cebc63587ca6dffce823d4cbf5be6

SHA256
ea9e4ef56672998f20739356373af4d951ce2f528ece2950ff095d89ac354ef3

SHA512
ae36b8ecc62c9179b127239c509b21019f0cab403038536ac40071e22f8b70b95890bf4eaef89de5d1f1e4120750c71798df85fc2327ebbec80488104919ebf8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
a1cb8927bf5c580275bbfe0ded3361c5

SHA1
5becacb7c3647d9024244925e4d2ebba1ab273d8

SHA256
a26e72439119e06eee9f801e4062a5981feb2630f13ce0fb315a0439ebbb6105

SHA512
1ac3f9bcee9ab528f8d32c8783b5d68a57c9c2af55c019bc85e2573bb0c768380397f9f9aa47093d5865a1047f342605f8fa4990d8c9bebabcdadb59626a6b40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
69341ff04630ca0e4f425cd6441570c4

SHA1
b15149226ba096c587be4e9481017773d05d6c8f

SHA256
01ee97b2bb5cc25fa0f31fd165bfa400d2d98b5264ccc57a465692d1599674de

SHA512
58c27645e13b8c63ba831e2fadd9b53eb2bbbfdb6adb59a4907246b85ab0475835bcaed0039acc49976f30bf31852aa7ea7c24a5d7eae22764edc09ad2bb1209

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js

Filesize
9KB

MD5
13c40926b6b1dd64e3029e857492a051

SHA1
115bf19c314a1693ec193e2503d440ea96a62003

SHA256
36e6575e85330cf8d7b1749ad63b528981dc968bf79d957ef8f4da21ca9b1ea7

SHA512
2e913b8ee6dc657f40757b0fb0f58a092bab1295b8b4e2d824cdc15c94bef193821d456d57eb30a491047109b5c3fb024a78d78313a963ee032b3fec1d7c1435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js

Filesize
6KB

MD5
055ee1b54a35b1b721409a7041f29397

SHA1
db2890a16d086026af983e8cbf832fae4f18feb3

SHA256
9df43faec859c796cd73febaff10ac1ae4f8881733a9e7c4ae77ccf535761f07

SHA512
51a0a8bdcbf4727843635187e948552c8655f6d4095641f7b42d3fbb583d35996aa6087b63249452b562600a3dd08b63be6680a24a8af2248b40d6d2d51a1d39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

Filesize
7KB

MD5
92f1bcc74e2abb32c180c80392ec4f85

SHA1
84f54ab7b1b63b3c49570bc618971f0b8aeda3ae

SHA256
2a1e72051c3869e236984369b0279105fa0c434f8cd5f38d1a283d3d62883f4e

SHA512
20d676f386d990b26108d19e7f0ce55b6b08763d0e943ec7cd6c4fae16e10ab9b9e6e97ff4b62a4d2ca316935cbc5210cc501ff50d98750b0f23f183907b6572

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

Filesize
7KB

MD5
51fc4f7e046ac42631c32508e3bc444a

SHA1
26c06b1ea8db4a8c53efd5987bf116aa50ed7b3e

SHA256
732f516181c2f0754903323a2b991b4d2514422648e105cac02344f27b5ba936

SHA512
68c1ccb134209c0afcc3ecad3e4aa6b4ac4704e573cdba8dcddfad8fab1c832b1962f3bf23cffc0490184dae78aafa72e7f8fdb6c09bf97de9dfba5de730e4c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js

Filesize
6KB

MD5
a85be158e2b81a7edfdddb583d548f82

SHA1
78b2cbc9287780afcd94aff6e9c3e422fea60774

SHA256
22dcdf2b3a9f1594f8b2fb90b39cec395fc24a771f45abf08014f69cb07e49f1

SHA512
959f2d4f4f6a2ec0f07cec63657a73a21fcdd1dfc1187d086f2058e12fce0d0e3c28016285adf0bab30be067b4751e85609d250dd74c04ac18d894ac91549635

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
cc704c9f0972a67831cdc79de8495a89

SHA1
326ee3172f71091503bda88e5cf76e287146fe85

SHA256
fc8764bec3e46c472f311ee47dd22f5ea170ab61b8279c287f1aa621952c86a5

SHA512
fcc7f42a3fba494d7fec5436399e2a5967b1651a112ec240ba0c9d10f5f63a360a4d9987c78a0086991a9ac041c35de12827c0ac7ad8e03faa53360c8746d003

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
cd3528528d8b140f5a15ed24cf1be7a7

SHA1
281096eee05684cae22e9245e31add26833ccc0a

SHA256
acec3c8ea214c28ff266b7a2a4e4e0b54d57564aa49e1793b54c304089781015

SHA512
cb38240fd17d1135bddf06614d32aa825a1cce60f5dfb1dc2647ded70b1674635e3bc5a3365df1e419167aaf386d613268199760d750b40dea564de11ff9e013

Download Submit
C:\Users\Admin\Downloads\host-7.2.2.0.exe

Filesize
22.3MB

MD5
ecfc0e68ae8ca36fae7c694a340fe1e7

SHA1
07f6e2bcbf12c6248eeec9f46961d1d6f76ad25e

SHA256
7575eef6585aadd0e67524fea6cbefc7a5fce028fdcb8181fa740a7ad7df9fff

SHA512
6ab4fa32edee48471199fe90acc135d14ede23570a49607b6d27af45fa3c5d6546c1ba19157ee80270a6825f84a4e7c63d4633a2b4874550cc15a1a237f32f91

Download Submit
C:\Users\Admin\Downloads\host-7.yS5CCl-h.2.2.0.exe.part

Filesize
6KB

MD5
1a5512968290dd88e832278ec0d38cf4

SHA1
4c1cf97c31dd3ed4943ab22d8f3e59bb437c4983

SHA256
5b4c39aa041cd32e39cbfc235f992cf64beb408180addf2e743fef927324fc70

SHA512
dc8d2f06514ecc6e9ae3010b5485c7956b5308606c875c23ec5984daa2a61ec89a3d12aef7ec8e69d2b2a7900fbf9b177aba67c25cd761e9f1111e6e643d2505

Download Submit
C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe

Filesize
69KB

MD5
c5d9ad25a352ab74b481cb2a0e938e40

SHA1
400d21eeb68a31136c49c4fe5b3fc042cb278cab

SHA256
885c1cd9c61f93c7284fd1da853d5c58000419655525413ca469b9d5e806403f

SHA512
e919646b606b2c8984d1dd9ff5b6fc4f92930290339263d56487da8a702ec68551b2950e20ef531b452022f3f9fb61a72f73196826ab3e70bde5521717666fd5

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
72058689ecb4f05749a4b2af39d8449d

SHA1
7a966cb18622c8ca8cca5482aa443f1742a6c854

SHA256
3b35a845d16e48b4a298c67abe62428b3d0420f2e6e3b201022b25d26a104004

SHA512
a23d17c88ce52c2c8cff5c3fe58a27edff7655fe72ab403513d7bbcb3e1d47dc1d1dd3a3e70220bd17237fa620920a7194ca53a8ad54b96bd0fbf1d5e6d49647

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3252bcca-e7b2-492e-bb77-9bbea2fccf37}_OnDiskSnapshotProp

Filesize
6KB

MD5
c3077733091aa1c7d459173552578a0d

SHA1
f62f058ce3443030e3a5e16933db3f08e16d8268

SHA256
27ef4bc1f7b3dd29b32b11014093a28341e3e63c77227b77dbe7f04e966f50ff

SHA512
51efd38418a0109b0521d2b49af8584f107d49d9be7bd7575414393b24102bf9e27c89f198edaa8cfc2189caa91f3b53bc8e5aa45c0fd90d757e9607591dd5c4

Download Submit
memory/2252-98-0x0000000000400000-0x00000000033B8000-memory.dmp

Filesize
47.7MB

Download
memory/2252-99-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2252-127-0x0000000000400000-0x00000000033B8000-memory.dmp

Filesize
47.7MB

Download
memory/2252-367-0x0000000000400000-0x00000000033B8000-memory.dmp

Filesize
47.7MB

Download
memory/2252-146-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2684-411-0x0000000000400000-0x00000000033B8000-memory.dmp

Filesize
47.7MB

Download
memory/2684-422-0x0000000000400000-0x00000000033B8000-memory.dmp

Filesize
47.7MB

Download
memory/3472-398-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-428-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-300-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-362-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-340-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-372-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-425-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-378-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-418-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-382-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-332-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-409-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-390-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-406-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/3472-394-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/4964-299-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/5552-257-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5640-253-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5692-239-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/5780-278-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5956-349-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5956-336-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5956-296-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/5956-319-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6024-295-0x0000000000D80000-0x000000000189D000-memory.dmp

Filesize
11.1MB

Download
memory/6084-423-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-376-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-396-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-320-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-426-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-416-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-360-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-370-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-297-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-380-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-388-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-407-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-392-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-399-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download
memory/6084-337-0x0000000000440000-0x0000000001930000-memory.dmp

Filesize
20.9MB

Download