rms | 34ef6abde1f0b4e58c5a259ddd847e562810482e45f6c68a282e8c7b01b57b6d

Analysis

max time kernel
148s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/03/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-24_69fe6309ca8860aea7ecc631247d47a2_elex_wannacry.exe
Size 11.5MB
Sample260324-fnthzaa14x
SHA256 34ef6abde1f0b4e58c5a259ddd847e562810482e45f6c68a282e8c7b01b57b6d
MD5 69fe6309ca8860aea7ecc631247d47a2
SHA1 751bb43f3b4ca87df9346b4205511c3cfbdeb5c8
SHA512 fc9a6b6915e2f9ba0b7af292fef5a55fd61f42f27bf1bf1caea7a47c746004177a4897bb89009f9ff6bc6ce380a2286d079721dd9acde9b472265c7fcd25abf4
SSDEEP 196608:yfUBa+pyI7rNPevUnI3UEwzGwuAaPOqlS2uTchRcxH1U3m7s++zEAWtzmmUJAs:yfUsI7rIvUIkEwzGBAa2uvcx1w++z+Sn
TLSH
T1EBC633992EC191F8C3C460F29BB62E525AF97B731118C3FADA3005469B7DB99EC4B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery rms rurat persistence rat spyware trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Rms family
rms
RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat
Rurat family
rurat

Custom signature

Detects executables packed with VMProtect. 23 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b3d9-6.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-15-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-16-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-17-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-18-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-19-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/files/0x001900000002b3f3-138.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3088-140-0x0000000000400000-0x0000000000A06000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4440-145-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/1288-154-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2416-256-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3404-261-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3036-278-0x0000000000400000-0x0000000000A06000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3144-276-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2704-285-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2704-425-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2600-438-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3144-441-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3036-443-0x0000000000400000-0x0000000000A06000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3036-447-0x0000000000400000-0x0000000000A06000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3144-446-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/760-450-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2832-452-0x0000000000400000-0x0000000000E23000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Driver = "ruppm.dll"	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Ports\rup	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AgentRunOnce = "C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe"	rutserv.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4008	msiexec.exe
3	4008	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unires_vpd.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.gpd	spoolsv.exe
File created	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFE.tmp	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd	setupdrv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rupui.dll	spoolsv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.ini	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFD.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\system32\ruppm.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.ini	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui2.exe	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\lockscr.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.gpd	spoolsv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\stdnames_vpd.gpd	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\lockscr.inf	DrvInst.exe
File created	C:\Windows\system32\ruppm.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.lng	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFF.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll	setupdrv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.lng	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\lockscr.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrvui_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp	spoolsv.exe
File created	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFD.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\SET2BFF.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.hlp	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.lng	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.ini	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.gpd	setupdrv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rupui.dll	setupdrv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd	spoolsv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\French.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\German.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ruppm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Korean.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Italian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Polish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Danish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC2374EA7A2C403DD.TMP	msiexec.exe
File created	C:\Windows\Installer\e5813d5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4244E916DFC01965.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\VPDAgent_x64.exe	srvinst_x64.exe
File created	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\e5813d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE9A17726DB5A6A8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16EE.tmp	msiexec.exe
File created	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\VPDAgent_x64.exe	srvinst_x64.exe
File created	C:\Windows\SystemTemp\~DFAF3665935A415E44.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E945283B-758C-4A40-B851-1066D0E49EA8}	msiexec.exe
File opened for modification	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5813d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\INF\c_monitor.PNF	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A6A.tmp	msiexec.exe
File created	C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	drvinstaller64.exe

Executes dropped EXE 19 IoCs

pid	Process
2600	installer.exe
3088	rfusclient.exe
4440	rutserv.exe
2416	rutserv.exe
1288	rutserv.exe
4552	drvinstaller64.exe
3144	rutserv.exe
3036	rfusclient.exe
3404	rutserv.exe
2704	rutserv.exe
4844	srvinst_x64.exe
1272	srvinst_x64.exe
2508	setupdrv.exe
3272	setupdrv.exe
4472	srvinst_x64.exe
4088	VPDAgent_x64.exe
2324	srvinst_x64.exe
760	rutserv.exe
2832	rutserv.exe

Loads dropped DLL 28 IoCs

pid	Process
2280	MsiExec.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe
2868	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-24_69fe6309ca8860aea7ecc631247d47a2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4800	PING.EXE

Checks SCSI registry key(s) 3 TTPs 34 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rutserv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rutserv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Remote Utilities Printer = "winspool,rup,15,45"	spoolsv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductIcon = "C:\\Windows\\Installer\\{E945283B-758C-4A40-B851-1066D0E49EA8}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B382549EC85704A48B1501660D4EE98A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\PackageName = "host.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\PackageCode = "C2B715477A86B9840B3BD5A0C6916BB6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AuthorizedLUAApp = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A\RMS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Version = "117381777"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	drvinstaller64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	drvinstaller64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	drvinstaller64.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4800	PING.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
4008	msiexec.exe
4008	msiexec.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
760	rutserv.exe
760	rutserv.exe
760	rutserv.exe
760	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	4008	msiexec.exe
Token: SeCreateTokenPrivilege	2576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2576	msiexec.exe
Token: SeLockMemoryPrivilege	2576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2576	msiexec.exe
Token: SeMachineAccountPrivilege	2576	msiexec.exe
Token: SeTcbPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeLoadDriverPrivilege	2576	msiexec.exe
Token: SeSystemProfilePrivilege	2576	msiexec.exe
Token: SeSystemtimePrivilege	2576	msiexec.exe
Token: SeProfSingleProcessPrivilege	2576	msiexec.exe
Token: SeIncBasePriorityPrivilege	2576	msiexec.exe
Token: SeCreatePagefilePrivilege	2576	msiexec.exe
Token: SeCreatePermanentPrivilege	2576	msiexec.exe
Token: SeBackupPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeShutdownPrivilege	2576	msiexec.exe
Token: SeDebugPrivilege	2576	msiexec.exe
Token: SeAuditPrivilege	2576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2576	msiexec.exe
Token: SeChangeNotifyPrivilege	2576	msiexec.exe
Token: SeRemoteShutdownPrivilege	2576	msiexec.exe
Token: SeUndockPrivilege	2576	msiexec.exe
Token: SeSyncAgentPrivilege	2576	msiexec.exe
Token: SeEnableDelegationPrivilege	2576	msiexec.exe
Token: SeManageVolumePrivilege	2576	msiexec.exe
Token: SeImpersonatePrivilege	2576	msiexec.exe
Token: SeCreateGlobalPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe
Token: SeRestorePrivilege	4008	msiexec.exe
Token: SeTakeOwnershipPrivilege	4008	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3036	rfusclient.exe
3036	rfusclient.exe
3036	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3036	rfusclient.exe
3036	rfusclient.exe
3036	rfusclient.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2600	installer.exe
2600	installer.exe
2600	installer.exe
2600	installer.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
4440	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
2416	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
1288	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3144	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
3404	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
2704	rutserv.exe
760	rutserv.exe
760	rutserv.exe
760	rutserv.exe
760	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe
2832	rutserv.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2600	1056	2026-03-24_69fe6309ca8860aea7ecc631247d47a2_elex_wannacry.exe	79
PID 2600 wrote to memory of 2576	2600	installer.exe	80
PID 4008 wrote to memory of 2280	4008	msiexec.exe	82
PID 4008 wrote to memory of 3088	4008	msiexec.exe	83
PID 4008 wrote to memory of 4440	4008	msiexec.exe	84
PID 4008 wrote to memory of 2416	4008	msiexec.exe	85
PID 2416 wrote to memory of 4552	2416	rutserv.exe	88
PID 2624 wrote to memory of 1584	2624	svchost.exe	92
PID 1584 wrote to memory of 5060	1584	DrvInst.exe	93
PID 3144 wrote to memory of 3036	3144	rutserv.exe	94
PID 4008 wrote to memory of 3404	4008	msiexec.exe	95
PID 4008 wrote to memory of 2704	4008	msiexec.exe	96
PID 2704 wrote to memory of 4392	2704	rutserv.exe	97
PID 4392 wrote to memory of 4844	4392	cmd.exe	99
PID 4392 wrote to memory of 4800	4392	cmd.exe	100
PID 4392 wrote to memory of 1272	4392	cmd.exe	101
PID 4392 wrote to memory of 2508	4392	cmd.exe	102
PID 2704 wrote to memory of 3152	2704	rutserv.exe	103
PID 3152 wrote to memory of 3272	3152	cmd.exe	105
PID 3152 wrote to memory of 4472	3152	cmd.exe	109
PID 3152 wrote to memory of 2324	3152	cmd.exe	111
PID 4008 wrote to memory of 760	4008	msiexec.exe	112
PID 2600 wrote to memory of 3104	2600	installer.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-03-24_69fe6309ca8860aea7ecc631247d47a2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-24_69fe6309ca8860aea7ecc631247d47a2_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 03DC4760834A4CFA5A519AD480471041
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2280
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4440
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -dispinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe" -dispinstall
    3⤵
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:4552
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3404
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /printerinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe stop
      4⤵
      Executes dropped EXE
      PID:4844
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4800
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe uninstall
      4⤵
      Executes dropped EXE
      PID:1272
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
      setupdrv.exe uninstall
      4⤵
      Executes dropped EXE
      PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
      setupdrv.exe install
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      PID:3272
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe install
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:4472
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe start
      4⤵
      Executes dropped EXE
      PID:2324
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:760

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1288
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -second
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray /user
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.inf" "9" "4351f1d4b" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\remote utilities - host\monitor\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{7A95C579-4D6B-416F-ACCA-647E0134FB4C} Global\{6C579809-1D7B-41D0-AC93-C0493D950F5B} C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\lockscr.inf C:\Windows\System32\DriverStore\Temp\{40ffae4e-0614-864e-8de0-03e9e5111502}\lockscr.cat
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in System32 directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2868

C:\Windows\VPDAgent_x64.exe
C:\Windows\VPDAgent_x64.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5813d4.rbs

Path C:\Config.Msi\e5813d4.rbs
Size 23KB
SHA256 65072cbb2d8cc797930a14db4073778ce2823c31258894ce8eea0a4c1964e869
MD5 d6de468b23d8047b5a7b13181d072986
SHA1 c7e83b028bde59d50b445532d7064a7ca69f66b5
SHA512 a69279d96d0a9c896407349a387a5e9c4a1fa94f7713428a66986acfd85c57150902f24c861784b85d6eea755ac7cf36053c11c634ec616807ea14289ef0a55d
SSDEEP 384:5p8dlEnO1h6RtototiGm1DkD2hZxe4ooOMmD3DpnPguDpJ7BFoJ7Bw9QG6+:5PtototiL3TrmhnouDpiYBT
TLSH
T145B23161AA02C9C2FA0566B77F8A1D5A23229B47A38C0F2715CC56645FD1F4C3A3C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arabic.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg
Size 49KB
SHA256 5810c1f2453156015e43dc8844b8463eaa47be877c07834e67723815aa60c5d3
MD5 e51a34c8198ba9a59e53f0503777e75b
SHA1 83d93b4a520b08efa14b55c80c5db8f85d5ca9e4
SHA512 ed8c7684eeb24afae4f8cffccb870192e5ecb918843f2530439398d5cee783cafd375f851c0334ca6f1272196af984e72e3864a388f243cd6d82449151b722bd
SSDEEP 384:8uSWZIpfcBVSNiDvZI/BMJkb7/DvVVqx8sjXDtnMKhcD66KnLQ+IpvcuDudd3tzu:oaI5M7rhcDx+LnzBs
TLSH
T1AA33FA017BEC8238B2F71B94D6BAC0934B75BCAA9CDCD53D21A6041D04E1A5189A7FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chinese Simplified.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg
Size 37KB
SHA256 4d646a6af146c05cdb4644f62605cb40196595e6ed3aabcaf92e7d081c4eebf1
MD5 844e2b8e4ad580ff845402a6b3b88846
SHA1 1e76d2008eee1a896d207dd9c3c1a504dc9d06de
SHA512 01590c09f0cb43e1ccbc27b591a06ee16485a176439512f121a1b29d1fdc8ba9eb216a26c619abdd3ca8b441d80bd23ab165cf9f36e7ade0fb57f60645ff94ed
SSDEEP 768:w4ZeAyS/v3c0kjkcpH7O0ne68XPfHynIlxBQk6WoB:fZeA5voj/Y/HHyv
TLSH
T1F803A54273FD0604F5F31B84E9BAD4A44A79BCA9AC2CD56C34D7046E44A1F4198A3BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chinese Traditional.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg
Size 37KB
SHA256 ac397a585dd2e48f8ee01d2e50d4d87e138d24d6f6f7c442507feab796c3a9ed
MD5 420f3450e1dbf4ecbe48125bef79155e
SHA1 eedd628146fe8722aa8f5a9cc9a84ff86bc403ee
SHA512 7b14bccb0daedf62186fafdb9224ce5c96b493950e4c7a9c6c9d330831c4e660efa77bf661a39bcb5b93014a9c3a7f28a633c4f6a1618b2a7ea551e811950857
SSDEEP 768:YP1tFWwXC1a0ogJWbXcTRB4N24nXX3G6FnVxCn3be+4:Y9t/C1atb1XHG6qU
TLSH
T18303924233FD0208F5F71BC4E9BA94945E79BCA9AD2CC66C34D6046E44A1F4198A3BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Czech.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Czech.lg
Size 52KB
SHA256 f1900d97610996e7a71c354f3899c26324e5a5493374a4d697558e4c4f669257
MD5 d39727c9980021059a0f2073277e039e
SHA1 a59b8f6d517741a8cf8c88cbb9bc7ddfa8879f75
SHA512 f0fa8eed8f9b72775c8c574edb4299cced7e6ca71c3cc907d1914d3cd6a86987fc7b031960b8d496030ea9b2b4eaecddcf5d0f5ee6236514e0d21232680e9c15
SSDEEP 1536:O0vOy1dWVToDCWJRxHHO4hspLBPxrEXvLZJKQn6TYbjL6bgC+cYP2k:O0vOy1dWVToDCWJRxHHO4hspVPxrEXvd
TLSH
T1A533704333FD0244F5F71F85E9BA85B14A7ABCA5AD38C65D6096015E08F0F81D8A2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Danish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Danish.lg
Size 52KB
SHA256 3db7b110d7df4402b0ac207d28debb735cfd476ef42c2f71bbba5108a0b96da5
MD5 ab723f51a48801456d39bb48396beada
SHA1 a721d0afa24cbfb99c97431be42113426ab6638f
SHA512 b5fe82a2d00f277bf9fd75fae659a75e7f3aeb6629c6e034c7d9ee477abcba89dc4661035310ffdebd6aa3115c79c7621bf42af43b32568d5408d229b4d285bd
SSDEEP 384:gT1z3OH0gvqC4T1AIP28VpsjIvAAcs1jrnLA7lFTt9jMAlI4r:DHqTv5jruTtD
TLSH
T16C33514233FD0208F5F72B94FDBA90A44A75BCA9AC38D61C2196045D48F1F95C9B2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dutch.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg
Size 55KB
SHA256 83813ca174f76a126e05f6cca58be24ce2a48a2632e9bf6bfa46a353d01111b6
MD5 00c905e8da73cf386c210d28e3797f6c
SHA1 512b1c68ad520bbd77733cf71e376333c509c183
SHA512 b302035bd8379ddc18be49575b92cfd0219b6847cbd2d9acb9d6faf26fc0b0774bfae11a599e52266849663c5adf3de2c217ca5214339bb5400daae5ac35363f
SSDEEP 384:SKgzSDh81zMEAgcj6Av24RMDQDLXedTvjq0RjD8ZbK6BmmhWYpjUwkQZQuxtWv6M:SY21zVg+aeq0Rv8ZbnTFaObLfWucLOmD
TLSH
T1CD43504333FD0208F5F72B84E9BA90A44E79FCA5AC39C65C2196155D48F1F818DA2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lg

Path C:\Program Files (x86)\Remote Utilities - Host\English.lg
Size 52KB
SHA256 fe57254a0c2a3593d618bea7d43074c7b637ec3021f0b51073c0d95f65bae882
MD5 6396e5ade56e4f45c4f59ca210385f58
SHA1 88f8778e8f960001ee558255e22418d8ea17446a
SHA512 58d0b3a45249338b41affbdc81cf01fb68e1f710b1f378bcc4eae58d6e8e8402be0a06c9b4e74a4cfa1d2631ad9281921a081bf597b24f12f7ea2a4fbcd5d020
SSDEEP 384:bKrZjali4EH/1NesnYQ90NfOgisWZBAosFwmlefDYsOsFPJjs1TqjB:e22TZGvlefH7x
TLSH
T11833FC4263FD5204F5FB2F84E9BA90644E76BCA9AC38C65C1192005E56F1F81CCB2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

French.lg

Path C:\Program Files (x86)\Remote Utilities - Host\French.lg
Size 56KB
SHA256 0b05f6ada359e0c3295d32087874bf2888e60400fe3a9ec4d54a849031bfe915
MD5 7c2276331e1e744cf702858fbb041039
SHA1 a5c7c0067a96b7e8cd11d8b3c205494147a2da4e
SHA512 e3fe3aafeaa6f295c53b2317aec8581a61260cc76072d814b913084b740397c3d77df4a63acc677f95aa6d40ff70fb52041432f903a128d5b54184c085d7a16b
SSDEEP 384:uGTDMQmpXpiwV+Bcp7D6AfZbKrHt/Adyu+AFeM12yATQHwUZAOqSA+lFS:PC1X2gyO13HbHY
TLSH
T11C433D5273FD4205F6F72F85E9BA90604E76BCAA9C38C16C2192055E48F1F41C8B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

German.lg

Path C:\Program Files (x86)\Remote Utilities - Host\German.lg
Size 54KB
SHA256 56b73a451ecc9d3f99892b397ef1b5006b6f9296765d01fbdc7fc3d979400bbd
MD5 42b83b0d09167cb42582b5f830b44ebb
SHA1 a9d5d467643aca034a983ebbb595d2fedd19062a
SHA512 2ef138d4e45554d594abbce7a2987fb17eeac63c607815120d4a415b7c3e3280a84b4068429d7743523c4366da0b5aec73c8152ec30185b3b18f14e39a22a781
SSDEEP 384:BWOrmAW/HVZK8sEy8hsNrcbzfwA/AlcLwhi55cR5WC/N4JdGy2TSZEQiNtp34hBc:pXW/0rcbjtlwhJR5j/2JdF2WeNtp3etS
TLSH
T1D0437F5323FD0318F6F31B84E9BA90A45E76BCA6AC39D55C2185055E08F1F81CDA2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hebrew.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg
Size 46KB
SHA256 6387f12ff599445016b7f5b191170f077fe50c8b986a7d9650abfb7ccb6377f5
MD5 516352f3ff5dc96d8cfbd6abf069aabd
SHA1 b52524bec89b956fba232d7a72205e63e029d5d0
SHA512 c42e0901731774a15a65c047d8b05551d789e130ac17b53e899bb88f9d6a6448050eaa45b47a2a4cabc333cd36a863cfc5722cb76aebe04c73d9617117f0361c
SSDEEP 384:XncbAZHwCIo7HKInFzEnac+Q8ZUUBIbN08bZavbiSoBV205ZT1xD1O8Vcm+yWQRJ:m8QSQp7hNRMho9H
TLSH
T1C323F94133F8C29CF5F29F86E97B846D4A75FD54582CF11E308A005D05AAF4189AEBBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Italian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Italian.lg
Size 54KB
SHA256 9848f250729fe0a81118aa027592ad0ef98d8428e808fa7bafa0903a93c4d94b
MD5 dfcc06cd5e145a631806c1d011ad0fba
SHA1 d53236889246db20ad22f4811d24c7257c9b635d
SHA512 35767772186b91f502698ce0fb7a25db3d9718fa0faa58f3f67fe711f841f95e14e89cb6bbbc476a29e568a93d670b205b616e07508c12f800d0e20cd3831e00
SSDEEP 384:Sm01Cwq1dgmzJFUr8jmu3xwZBdGsWbITzqlf288Fuz2O5qi4NZhhia2nQec7b8wH:EkcIzSiGwarec7IDVmA8eY
TLSH
T1BC433F5273FD0208F1F36F84E9BA90654E7ABCA69C38C16C2196046E44F1E55CCB6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Japanese.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg
Size 42KB
SHA256 4df73b25972b4388f2ffe70b88d4cfc739aed58dc0a72163b96cd407eb8d4388
MD5 58319662af8f62390737c9df99f23dba
SHA1 19d0549605e76343555a3486aac9b072fe47e878
SHA512 97fefa76088474a208e777026d6c4022d8490fe6773b8ca5fe07eaa3ac732a69bdc589c6d4f34cd6d4a41ba73f628fe8160205d4695559f81e6fa19a02a6cc16
SSDEEP 384:FOcgi7ScbYvKxPLpAgwCMH9yL/VcdnQZfGl/8gUeFmNyEQvxQpdX2vSV:llQKxTpAgcIu4f8UeLqV
TLSH
T1A913B54133FD0208F5F31B94E9BAA4A44F79FCA9A82CC56C24DA055E44B1F4589A3BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Korean.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Korean.lg
Size 40KB
SHA256 87ada3f861a2b04e39f633218b791cc9e08200dafe96b85538c2ce402fe1f0db
MD5 dc4e41d98050548860bf92ca11345962
SHA1 259fc2aa4622e202799bbb5d352e57da47a6988f
SHA512 7f7d18668248c5a3b5b7aacb5616c6dc0e562b8467a9a27ddd021690456b685af3c8dfc0b1fec746ccd799b5a9f41b0968628864087d1b3dbce79b52c49382b4
SSDEEP 384:Xj+dvdrVVSEriZidLa515S7tQKnZ+r8x1ubapR+YY6vviE5z/:yrRILS1bJnd
TLSH
T19313914233FD0648F1F31B88E9BAD5A54A79BCA96C2DC55C31D6056E04E1F41C8A2BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drvinstaller64.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe
Size 218KB
SHA256 5517516030166606f2bdcd34a4990dee896a22be1fc23c700fc16743520c519a
MD5 bf25bed1f6c00110503ae135e500ebdf
SHA1 4ac12609265f47f75f2cdbe0fa0bf313cfe5e149
SHA512 7f4c14382755b22159d2929503f7e515130e57893399beffa019b90452014520e8d58bb2ee2cb807449e6dd0462e57d092f10f3fe345f2ca355682b2fd616ecc
SSDEEP 1536:7UYAqkUIVQaz5e3fdDJVBbM4L6LG1F33AknTZ9IM3eFyINtiR+uqPXJeyr3XLT5S:lA1UIVuNJ3V+kRsoyrXLTvDLS2Ofogz
TLSH
T1A724912762908CABD5AA8139A8D18F38B53FB030432991DB57F1035DCA4BBF18D7965F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Norwegian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg
Size 51KB
SHA256 d3014f26e0b5bd84f694c8ad18f0de48ce3cbcbaa2f649070f161c64702cae3d
MD5 3cdf55746e6889e8fff300e54a287bcc
SHA1 57c38147c92b86f7bceeb4dbd9ad1d720410b07d
SHA512 df2fe1b2f16238c1de4b3982ed31cca71490eba41fe9588864b3a58f0f5ee8bf6ef28a63528e7bf06524780d19812e8cd3991472a82ed5559a6a32146c04830a
SSDEEP 1536:IzYWB3TwZOFLoAapzop2DL+p/uSAoILpUNW:IzYWB3Tw3XDac
TLSH
T165334E4273FD1208F1F32B85FDBA90A44A79BCA5AC38D61C2196115D08F1F95C9B2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Polish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Polish.lg
Size 53KB
SHA256 b885b4e1e7bea7c202c71313a60774143dd7cc18d1a0ec8412b47d53016ea3f3
MD5 da9d399b473ccff29e6e8f9a5723cbfb
SHA1 d878b4206aaf64384162e96673845e913db34c69
SHA512 893122ce6550dddd793668ea7ff68764ca7676de34d8385df42f09eee50e0ce09670e6aca1245331fb18589207b3870b5564896e4d65eedc229648d985314dc7
SSDEEP 768:FlnI42juO0ISxfcndYoIw+hPj6Ewz0EMlkHYoTZ:FZg
TLSH
T1B633884233FC0255F6F75F84E9BAA4A44E7ABC75AD38C19D2092011E05F1F91C9A2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Portuguese, Brazilian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg
Size 54KB
SHA256 b9793f0ede71f259dc242c926cdc8f70fdb241a8a0f22c7206fb51b7e0a43002
MD5 119f5f60b0d87bd3a9e34eefe510cead
SHA1 07835dce1a48d571d1e8a5a4ff1f47f44bac3992
SHA512 5596ab114a4bc5edf98db65e95e2daa367a43034793b07877e3533e98822721ee3293a00760c2367fd3088df681fa0397e1a263efac1fd6850a1e26670cd0678
SSDEEP 384:1ZxUvMzwgsBD5ujNuKXXXx2WGOwZD13jQjgmYc/+nxSIdIJTN/JmG:rIOaupD3xOOREmonxwTNX
TLSH
T13E43395263FD0708F6F36F85E9B994644E3ABCA5AC38C15C2092016E49F1F41C8B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Portuguese.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg
Size 54KB
SHA256 c6e7b98ea6fd6bd60d26c46ba6432000cf4c47c5ba137fb63e905cfc2b3d36ba
MD5 18e6affb3bee46aeaf86efb1977f358b
SHA1 0df0b1fb0e3e59bc2f52d2a2bdadd29bf0adebc7
SHA512 fb6428024e22b48c0a66f556973fb434a9a33593942541c1a42d175d0335a83152d8247f875138be014c5f9c98167003498717029eb36780cd7a374a3f59e6e4
SSDEEP 768:KBj5qg4szsX0erv9Xp3TV8yz5FJhD1sWnqzFu9nwd49ZJnE:0MYCvd0G3ZJE
TLSH
T178433C5263FD1708F6F32F85E9B994644E3ABCA5AC39C15C2092016E09F1F41C9B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.cmd

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd
Size 68B
SHA256 e71036db28270fff2f386049abcd8b1340f66871c3c6cc64195c4de30d886464
MD5 921adb25b2323226764ccface8bc087a
SHA1 0e657a741ec92704fe2e9b19f7eb0890cba02b1c
SHA512 b91cc962438e4a7afd4324b81d84b3721dc44a49e9c674fa92a5363f8e393ba64bf99aca852b375620d7a4e84a09a8af591df4531346cc936559f80a91cdc999
TLSH
T157A0024D5EFF9031ED182ACC408F3A40CE0308144EC222C0A8EF2528204330E8283303
MD5 SHA1 SHA512 TLSH

Submit Download

ruppm.dll

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll
Size 62KB
SHA256 b1f7c1fddd5b9618f3a3a0c9e06a843cb5bd03ea0b3c0b8999165bda4d8af90a
MD5 b7cbbb8253e2a012636a49bbab49da0f
SHA1 49a531030b95b9f3188103d23f3b0794da326473
SHA512 78368e52209b487ddf523a26eb8c3d3e55656f4ded1b200d43b0834d2e331db4e6d7bc61c3148a91b2ba96d8b02262551ea5d8e4e6c233f1fe00a98e65f948ce
SSDEEP 768:NVYuFANGodiRkCosD0UjJe3mzslw45MTD9DnQefczpibS/rpay2tbMOxrY578gNC:CQduxw45qhlSTpay2tQNZ3uDkpgYuD
TLSH
T137535C11A7A802ADE5A7C97891F5472FEAB1781517248BDF4670CA0EAF33FD29439703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupdrv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
Size 67KB
SHA256 6235b51372741d8d40092081d3fec92c3f0d7610a585705554e1c31c0a7988cc
MD5 6236301bb833a673e6321cab4325d760
SHA1 2936afefa375fe5ec1959138f0702fc997178949
SHA512 56f1291d1ba96e57c46fd5fcb9a056b2d19c4f621b7874280909a5b24d4b22187dccdef2a60c0ec2fa3ed0433baa9856aed0fed731a07366e798d4704b7481f2
SSDEEP 1536:zGQUp5qanwouh1hTSoSt7tNqsoZO4AigYx:z7Up5qoGh1pGqfO4Aig4
TLSH
T1A8632907BB9D01A5E662CB35C978432BE53A34101BA0EACF96B0C61C8FB3ED5D975B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvinst_x64.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
Size 42KB
SHA256 d52ad4e946067171204907df839ee990bf2e9afb2e7bf2995bdfdf16d04d24ed
MD5 378308e758a64237322037ef33ebe4a7
SHA1 9f5f27214079756c903730b06ffdbfef0cd4a15b
SHA512 5529dfcd4dd46f79b7fe82334ce9484b92c88574326c3196c944cba657b866335feab811efe6d07ca050f9764fa9a4780e359c01a1264867f5b352e5080b5e63
SSDEEP 768:Diz4Zm+Bz9l6D7cqAyK7Z933JAjcZK04topg2PKgGL:SkHN9HJAjcZnFpgY0L
TLSH
T1DA131A1A67E90290F972CE76F576422EAE7D385017B0A9DF86F0C408CF31FC298A5B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.cmd

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd
Size 87B
SHA256 f6ebaa2bc59841b72aaf3c03c7bfea91c75ec1f982f497d6b3d7fb7271cacdf6
MD5 24837286ab8b5537ea3967e0a7905238
SHA1 4f3dc09d2f0c9ede72577154b9954621dd30604b
SHA512 6b0cfd707fbab7034ef45b4864329a9ad01f649216fe13aede6bf6488b50020da65f8a3776c1b125eebe08aef6a848d04a33de8277a2ad3827c8869af1368c00
TLSH
T19EB002465D6BD0359C1D1ECCC58A3540ED5741544B865785DCDF1565504661C8591341
MD5 SHA1 SHA512 TLSH

Submit Download

RIPCServer.dll

Path C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll
Size 151KB
SHA256 05040b677d7697b4f97da173c6c07146d3bde327833fd2022bf2cb67f90389ca
MD5 435d9e1fd4b87308f0f91da25530d4ec
SHA1 a9b0c513b930f4c2ef86cb75a8de1fe16eb6d996
SHA512 9a84f8e75c855ca4d3892591e4d2ed4d37368d8ed8c28fd48093534a8283c21a483ab50d930adc10d8dda5fb25338dd247004fdf08dd9f60cf038a0b61fba33f
SSDEEP 3072:WvQPgrvHfETaxPSki7FlC+y/DPHSeqqSDUDPBcHnIO3gH:WvQovp07FGaXgH
TLSH
T1DBE33B1DA380CC76D2A20A344790AE34AB3E7A1293ED58BD5BF5885CCDD077D1A2875F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RWLN.dll

Path C:\Program Files (x86)\Remote Utilities - Host\RWLN.dll
Size 967KB
SHA256 e713f288a46aad762f76c945467bb3ea7c84edfc56cec1c4c1b40d9f919bdcc0
MD5 534d6f176f6cbc725f9e7db8028cd3f7
SHA1 35b53f2e344f4a908a551409d018a91dc58100d5
SHA512 1fc1bd8d094d458541596322588750ecc66a2b3f809b0361a5c104adf72972c4bf2f08e4b58f347e56afd4e8019942ba0ba3346a85169958de1cedfde5a15849
SSDEEP 12288:+EWFAQWGdxKCe/7BL83fQdRQ0TESX+EHjggwPzN:/ZG9e/tLHu0TESX+EHjKzN
TLSH
T15B255C37BA45A53EC5E90739067BB994587FB7216902CC9F47F44848CEAB4802E3E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spanish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg
Size 54KB
SHA256 c157ce11631f26462c764bab24b0700f019a2213b36a92002d886d156afa7b03
MD5 542fb52c74f0f92c5cbe734cf75145b5
SHA1 6bca28849913bf4f61b3d48791737a00f9718ee7
SHA512 ece3518e30d4ddc210afe82751f4b011d2d67fc8130f619656590c45710e3ac11674026445a33e880d13f60a6156c79923badff8d5f68d119d68ab2728dd7c9d
SSDEEP 384:VLBpSitsBwgxNMJN44gwUnz4j9U+u/ISQh1kSXZC1Zt/bqdDEp9lg0yBrJFuZj6P:FNPaNfWNJcZqwGCYO3S
TLSH
T1C943384227FD1205F2F32F85E9BA94644E3ABCA5AC38C56C6192015E48F1F41CDB6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swedish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg
Size 52KB
SHA256 88f45f3cc9999a1e35967cd7f33d2d15c0c31b13336fbf93e754e1af8903d9c1
MD5 6b46297240dfc309a99b133e94c916c3
SHA1 ce4f36af4cbf6ebd15cf6e0e6dc8b72e61872027
SHA512 6f808e7627d4d2ac06ec07f55ca72277c12a80e14fadd2822174349ebd0d5398dfcd73c301a4427a64db59b283f3d04a74be72f96e613db1540aeb9859af338e
SSDEEP 768:uExwiB90PPNythEEnIzmO250yOXu5sYA4YnXt:uni2PNytCEnIzmO2QXu5sYA4YnXt
TLSH
T134339D4233FD0618F6F35B84FDBA90A44A79BCA5AC78C65C2582045D08F1F95C9B2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Turkish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg
Size 54KB
SHA256 00d3aa64e2afe9b92f2d13255a86eee0f289d9d257229289de0e2020626f0508
MD5 8a4b15f09ab2301fdbf99acd5274bf88
SHA1 88bee09f9690dce0f323909d53525f60e076e854
SHA512 f2066e60c588b698f3d2d79d19a25b76354c4857df1eda51d60d1371c5a32a87211a8927c0817ef1e2a8ca1d50230516a4521be6e0b40c7c301d93d894548e27
SSDEEP 768:aE0cXwLfmn/ft4QtV82UByhgrhfOXXVLbxcmH6Aa7Tvf:aqXw4HRO1fOXXVLbD6Aa7Tvf
TLSH
T1DB43A65223FC0609F5F31F85FDBAD0A14B7ABCB5AD39C15E2592006D48F0E918866BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 5.5MB
SHA256 faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976
MD5 848a53dc549be0386e5da0f49700c389
SHA1 e918192d2b5c565a9b2756a1d01070c6608f361c
SHA512 fa3ec7f48ec441c1e68ca74d3b8436838b5a4fd5f767fb655d5ba19e82d5a7cc5d9706ae5e3eb53334ff1dc03ce589fcebcf4bdcb7cc27f69bfa6e3eb24f9633
SSDEEP 49152:fToOPDphyCs76leS+ZdHP0pCDYIHvdddCOQyxdN3AzqT2TNO9jiu5Ky987l:fToOHyCKZ1vdCOQybN3YkiQKBl
TLSH
T16F468C12B285753AD06B1B3A183BA75C597F7A603A1AED1A5FF8084C4F36D403D3A74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Size 381KB
SHA256 f14dab0b9f18aced330729b4a772e6b139817be01783b97b92e9af5fc26615d2
MD5 381f1b7d8f7da904827980dae02f77a9
SHA1 81d4d5724533b26391301be2b462f580395d5485
SHA512 44a5eee558c727c9c07301dc0190a00807d1749f83c57f76c4f8cdde4bbdf4b44bb1086cc2fcb7aff0a73949ae7aaa17d33d9cd3b0a70c4f51b724812e1bd6d3
SSDEEP 6144:JIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcW:JI8tiDOzyH9H8Tu6h04fZMZoMPuvf8r
TLSH
T12B846C11A6828131D8FE15B8ACBCEE95222CFE0D9F748DDBD38C294959B21D15634FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Size 1.6MB
SHA256 616a0047b5f28a071fc26dd9b0fd90d5110c77a3635565cebc24b6362d8c9844
MD5 3e6c2703e1c8b6b2b3512aff48099462
SHA1 b17a7f9cce16540b1f0e3dceae9dc7e8e855cb1b
SHA512 70d0c5cb8542ca0600d38aee9030ea3dd9b0951a7d96ac1b8f1af9e71c5357c33f433913ef9d2e3254a9ac95e5678764ab22184fbcec998a9bbb8d75731c9dc8
SSDEEP 49152:iSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwf:iSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS1
TLSH
T101756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Size 261KB
SHA256 d639adb51c6e3ee8c249d11eb8db606ba2aa37d4f12f80f2b9685d8f560984bf
MD5 026d12b240e081794c730c1ed24a6f33
SHA1 bb6c0544ecc2c8db68b23b8e4feab5b3261b4666
SHA512 5b88ee5c7cee966867eec31ad468aa19353a2a2b1a84995ac1bedeaf5e60b1b015f73fcd35644c4365cf8f1981b3de057483838b7deaad5599f9c2a24f60d758
SSDEEP 3072:BW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTB:BWSfr7sXSmPDbKPJ6/AsNk+ZgAl
TLSH
T158449D013685C075E9EF0271987CAB2918BDBD724B64C6CBE7881D4E1E316C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Size 366KB
SHA256 78115050f4e99372fc10b19a14af60e623ddfda224c8e96340cb5d8166507e2b
MD5 2943b9910b1c7cc04024888502885256
SHA1 e2ac697a558fa85ff4c9e2bb114138870a80f146
SHA512 8d9d0d60622b958ab0f7c1f1d050fb53ba11cf19aa513fde9f7b7772fb6949b3e50907ed519fdc89e2bdf0ffb33ff084094af56abd3f9d1d2faef9d27990fe1b
SSDEEP 6144:EaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtwgV:goPH0GgEp0gVd1ValsQXsHzV
TLSH
T15C847B01B992C57ED4EE017018AC7A4BD97A3A6D0778CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Size 861KB
SHA256 1a9632b9e061b56017d2eb8d15c20e60a9518b4de5faa0399eaba0a17c10045d
MD5 74a8ebf5d8e08e284d734fe5feebd67d
SHA1 87fb627c6e63eb41e26f389b38d525ccf0c11590
SHA512 230f84f3fdb335a6044e6a83154de27e853b66ce6b8963b5f1991c462d69cc702a5cf7ee20717ec9f6e688398579fe18102a48f418b74333f476255b1cdbf8b9
SSDEEP 12288:OTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNeb:lYF+Eyx2lzujtEIYRc1cQmsGa7ONeb
TLSH
T14B15B213F9929D67D7E8023100A1F5355622BCBCC3A35AF73F8476FD39A69805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi
Size 9.2MB
SHA256 f56c8cb9691f71a9b7b7df8184f5cac0d4b443ab4c6689c6afb5864a364525cb
MD5 e50716d498172f25c6e7424398be402f
SHA1 182f060837e73e9e6f959dc7d2d87d9fa9f9e5ef
SHA512 71aa7a865d0a0d13f5ec21d4801a24d23e578d2908d13cefb19b07a61a4ab421f4497651302401768cd4e5c3a9658e550ecf8b9b6008df92d444521c8bece386
SSDEEP 196608:WJRvzfEU0vFR51DupvqzsuvoYuFZnERejnTamopOYDmWM2:IdkvF3cpvMiVF9HoOYDw2
TLSH
T11EA6230636428032D59B473146BAD7384B3DFC23ABA181EBB394AD5D1DB37D069772B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
Size 9.5MB
SHA256 a803bd4522ec8804adf5e548b2ffc9e3afa7eee179d96945de1a5980b5616445
MD5 3c5850ef227bb206e507551c471ee8df
SHA1 8943aab98043f28918a0c8d31d7a0076b5bffb1c
SHA512 aa94ace9f008eeff257505239a7a04eada728461e7d732e227815c880b6ec758b63b2dc576af425489b661d5de23d002ff14121c8e0165fae9fd127404eb2f1a
SSDEEP 196608:6mzxqB4pQOdPLoDzS3lC7FCws+8w05anNfzY+ke8N:6mzxKxS5anNfceq
TLSH
T100A67D12B2C4663AD06F1A3E487BA754683F7F613A1A8C172BF05D4C4F366816B3B647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI16EE.tmp

Path C:\Windows\Installer\MSI16EE.tmp
Size 153KB
SHA256 756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
MD5 52185b209cfdb02d88b4a40a4bdf0911
SHA1 aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA512 8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
SSDEEP 1536:Ae5evr0fQtkUlPeG+U+n4PtjrqzN/cWJQaqYAJmmD+e7cKsWjcdlsKc8rlq6W9Eq:AievrFt0KyqmDqFJr+egmKc8rANw+
TLSH
T185E3391137E18070E5EE1A3959789A269B3FBC71DB7489CBB394024E1D70AD0EE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rup.gpd

Path C:\Windows\System32\spool\drivers\x64\3\rup.gpd
Size 14KB
SHA256 4c21b9663120b494d0f5112eb5f9e0aab4b659a5bf5d5301ee4d5a98abb20f25
MD5 151f3af412abd6bf05d160a70f8873d8
SHA1 0efcf48401d546ce101920496dcbbf3ab252ee87
SHA512 58513727d12cc915cd8445a078beb238aa3df28cc49b3733d487b0d3100f1c519b39f5b809ace618536e2d8951c1b3a58c0763a893bbd92a98c8e06575d92a4f
SSDEEP 384:U1EQCc2g2N2A2X2Y2j2+2BgQzaZah25Dy:3RLormTqdB1aZzy
TLSH
T1E562BD2C39D686CE207FEF36637B2A71F6A51BA790D2982638ACB9344F780155145E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rup.ini

Path C:\Windows\System32\spool\drivers\x64\3\rup.ini
Size 40B
SHA256 e1113b0f0daa2ce44dcc01dabfd8bdff21630c724a333868c87fb9822e60ebed
MD5 ec01a42770693558a18ba4c72d9ada05
SHA1 484bd82cabc1c6ecc8214b3c8e57258755725d79
SHA512 4144d4445c111f9020107fe68135b1117c7e382bbd56b8bffdee03b9188597554d4878728c69942193e703b1bebbb229c1f825fff520b0833ed8188b6666ef1c
MD5 SHA1 SHA512

Submit Download

rup.lng

Path C:\Windows\System32\spool\drivers\x64\3\rup.lng
Size 25KB
SHA256 7633ce5b3d2f8fea91207cdc1b2252b81606be1b5ffafedd56220cfd07f36c49
MD5 de5b0b40318ceabef85c04260141b039
SHA1 450df0a73f682425f631af1bd8b1960490498427
SHA512 2afdbce31039b77761173a3d8a87970a99b152a97048a8710b0d5b4876bd7602dbbf8b5315fe5f4da69d093871ee59c626198371ccdea6180d7e651b871ac91b
SSDEEP 384:h/0YR3H0kSALpeIoxEZBk/uVBE0P/ReIoxEZBkbLj8eNzPyv:hshEMEw3hsv
TLSH
T1ADC2C726D0CF454B5A3322CD7252930FB62B978EA919C15AB25E4F0A64C491C9FCF93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupui.dll

Path C:\Windows\System32\spool\drivers\x64\3\rupui.dll
Size 27KB
SHA256 0806ceca08c227323e519ecdfd3964a135491de98c2c804714c30ae0a6d60d83
MD5 838bdfdbee82353867fa0a2fab93f0c6
SHA1 3ee02d95019c900331a5222d939c8e3ced1466b8
SHA512 86183b1e520721f21537b86145b5fe059a257cbf42bd8b7395ec1cfe0128f0b7026a2a577e1c49502da1d355e5a6a3bec847e39e1ab835da74993276c8952628
SSDEEP 768:fDEgAAkx/u2FRVZlSqENE0qmYBg2PKgN6:2G2FRVbTENl+gYf6
TLSH
T13DC22911A7E84C06F9B3DA7569F59A29EE72B810A770C2DB6230C14C1F767D2C938367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdnames_vpd.gpd

Path C:\Windows\System32\spool\drivers\x64\3\stdnames_vpd.gpd
Size 14KB
SHA256 2835a439c6ae22074bc3372491cb71e6c2b72d0c87ae3eee6065c6caadf1e5c8
MD5 7162d8977515a446d2c1e139da59ded5
SHA1 952f696c463b8410b1fa93a3b2b6dae416a81867
SHA512 508f7ca3d4bc298534ab058f182755851051684f8d53306011f03875804c95e427428bd425dd13633eec79748bb64e78aad43e75b70cc5a3f0f4e6696dbb6d8e
SSDEEP 192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
TLSH
T15252F9A014F0ED5B1A7AC316BC6D8786A269814F03E2E52C735E59760FFF96295E203C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrv_rup.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrv_rup.dll
Size 476KB
SHA256 c0dd92fc02a3cf76ed20ba35143f7415dd8a551cede52b89cf427d68f94788f7
MD5 0196a6dde7cae35cd1acb8d8902dd99e
SHA1 0dc6e8d2fbc49f6f42ecfb9b16a3fbc1425930ca
SHA512 37ec61ffc9e35055786ad578ac8b14fcb4f5265167a51635d815e75d31d307f23e10b50e1deec5d3d19594658f52c6a395309832f3ece4606986bddb9f8abe8c
SSDEEP 6144:ugjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvBg+:uglSTPaRxFdLXyJ/ebEEkx0rqJduE+
TLSH
T170A45A4AF76104F5C4ABC074C666DB37EF76B4B910049B474BA2DF722B23B905A1B326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrv_rup.hlp

Path C:\Windows\System32\spool\drivers\x64\3\unidrv_rup.hlp
Size 20KB
SHA256 0c02b226be4e7397f8c98799e58b0a512515e462ccdaac04edc10e3e1091c011
MD5 6798f64959c913673bd66cd4e47f4a65
SHA1 c50faa64c8267ac7106401e69da5c15fc3f2034c
SHA512 8d208306b6d0f892a2f16f8070a89d8edb968589896cb70cf46f43bf4befb7c4ca6a278c35fe8a2685cc784505efb77c32b0aabf80d13bcc0d10a39ae8afb55a
SSDEEP 192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
TLSH
T17692846A388DC846EB44C27DCAF17BE94D295C718EF09687F9897B0CA830E15E299458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrvui_rup.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrvui_rup.dll
Size 872KB
SHA256 dcf09e534f75b6a17b5967eb3cde8b832c408883946d34a256d44ed82088b86c
MD5 a258df1a1f90f833d05d5e5766a437c4
SHA1 0f90f2dff99b1783f111c199f383c5df502f5174
SHA512 3c5e0b009a1fec0cc0f1ac55f6c2201fa725a13369527a7fe25fcba3d29f5f7634e625cc712740d27983dd956166b1e4888686b143d85fd143013bbecd2efb33
SSDEEP 12288:UpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23soO+:GZ5F/bYogxJUB9cwtHFMDb+
TLSH
T143150901A3FA0169F1F3CB7499B58256DE76BCA56B35C6CF0290425E1A32BE0DA35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unires_vpd.dll

Path C:\Windows\System32\spool\drivers\x64\3\unires_vpd.dll
Size 753KB
SHA256 eff1dd9bd6fb1d432dc5475a8ccaecd34fa62147e59dca9183997fa5bf43bb99
MD5 170f3a1e4e6167b9c192a83404cb80c5
SHA1 a966d0809fcce693296cc02778e00e723fc298bf
SHA512 87fd44a9387087e097eb85118abeadf9a3a13fd33fdbb1585a2336ae5d1e266e712e1c238e7de8a73ad2a2ebd067732aa39b1b03d327d6fe7df0d03ac3c74ea7
SSDEEP 12288:1kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLT9:rzBEGbL4Np84TQazCSiRT9
TLSH
T10EF45C2A76FD6E06F6B32A7128F1095735FA7C48837CD72D2280B75C995E7542820FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.sys

Path \??\c:\PROGRA~2\REMOTE~1\monitor\x64\lockscr.sys
Size 15KB
SHA256 6b4e94a66e1325aa746da3a0a34f1b3618a1ab008d9187c604e620e52f8b21ed
MD5 5ccfe71b2ef1b5df69bf50885b84128f
SHA1 79ecfa80fb565cb59a64a1d316d52b57ebe2cd4e
SHA512 347932a9808fcaf0bb213b3f12c37184c56989dd3b8cc2609a7eb8566b1cb51597191c4854e3ba46ea51fa2904f2a82d0af92b7df5b6d31f40a621f89a953983
SSDEEP 192:fJxu7TS2JihqS+nWvnYe+PjPJdZubhlCVuuImqAZscF8Bd1LcdUf:fPu7YUmnYPLXZgwgAZsHLcWf
TLSH
T17D6229A2AB756C83EEA7CE3522E8C5967D71F650B791C5DB501AC4854E81FE1347C20C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.cat

Path \??\c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.cat
Size 8KB
SHA256 beb45913bc014d70ceb9e061b9683de36fe3d000f425c4df6151be1a37c6fb0c
MD5 a9790fa84c8d1511f3b7f9dc4c97435f
SHA1 0342a477e0a8779ad05e716f4d563ff676e1b2a4
SHA512 807361ea6cdbb04b359db7adc95b3e58dcabd252d3ee39f9bfb7a3695cf9ce3e7fac2def8be3dd20c617e5b60d98811d97c69aae2f381716f19df8fb419f9bd8
SSDEEP 192:enYe+PjPJdZubhlCVuuImqAZscF8Bd1LM4L4Zyi:enYPLXZgwgAZsHLM4E
TLSH
T14E023B95AB5A2C82EDD3CD2135E4D47ABD31B786F850C4AA616EC1609FD0FE136AC01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.inf

Path \??\c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.inf
Size 1KB
SHA256 097c3da78321ac553966d4ebabfe1a533dbb1b383010ebf165eede9c631dc6dd
MD5 a4e8736aa55b109b40c786a637991116
SHA1 20c1b886361974bcb608a79b2fd7598092ae821b
SHA512 912e84b813cf6b25303c0011fcbcc1fdd0dc3889aa4748dcbd99ef95986587eb98975bbe7ff88dec6d19b33f8d916eb8c9107895e6f2b0c05bbbca956e665b90
TLSH
T101318879401B852AE813733A3D5B77427369310270E45A11B0DCC2D0AB7EE1CAB2A2FF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-450-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/760-451-0x0000000001270000-0x00000000013BD000-memory.dmp

Download

memory/1056-219-0x0000000000AE0000-0x0000000000B9B000-memory.dmp

Download

memory/1056-440-0x0000000000AE0000-0x0000000000B9B000-memory.dmp

Download

memory/1288-154-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/1288-155-0x0000000001280000-0x00000000013CD000-memory.dmp

Download

memory/1584-253-0x0000022F51740000-0x0000022F5174C000-memory.dmp

Download

memory/2280-434-0x0000000000D70000-0x0000000000E82000-memory.dmp

Download

memory/2280-266-0x0000000000D70000-0x0000000000E82000-memory.dmp

Download

memory/2416-256-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2416-257-0x0000000001260000-0x00000000013AD000-memory.dmp

Download

memory/2508-275-0x00000000008F0000-0x000000000099E000-memory.dmp

Download

memory/2576-264-0x00000000009D0000-0x0000000000AE2000-memory.dmp

Download

memory/2576-435-0x00000000009D0000-0x0000000000AE2000-memory.dmp

Download

memory/2600-17-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2600-16-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2600-439-0x00000000014F0000-0x000000000163D000-memory.dmp

Download

memory/2600-438-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2600-19-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2600-260-0x00000000014F0000-0x000000000163D000-memory.dmp

Download

memory/2600-14-0x0000000000C40000-0x0000000000C42000-memory.dmp

Download

memory/2600-18-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2600-15-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2704-425-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2704-426-0x0000000001270000-0x00000000013BD000-memory.dmp

Download

memory/2704-286-0x0000000001270000-0x00000000013BD000-memory.dmp

Download

memory/2704-285-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2832-452-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/2832-453-0x0000000001340000-0x000000000148D000-memory.dmp

Download

memory/2868-455-0x0000000000AE0000-0x0000000000B8E000-memory.dmp

Download

memory/2868-456-0x00000000010A0000-0x00000000010AC000-memory.dmp

Download

memory/3036-443-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/3036-279-0x0000000000E70000-0x0000000000FBD000-memory.dmp

Download

memory/3036-278-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/3036-447-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/3088-141-0x0000000000FD0000-0x000000000111D000-memory.dmp

Download

memory/3088-140-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/3144-276-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/3144-277-0x0000000001260000-0x00000000013AD000-memory.dmp

Download

memory/3144-446-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/3144-441-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/3272-423-0x0000000000750000-0x00000000007FE000-memory.dmp

Download

memory/3404-262-0x0000000001340000-0x000000000148D000-memory.dmp

Download

memory/3404-261-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/4008-265-0x000001960D610000-0x000001960D61C000-memory.dmp

Download

memory/4088-457-0x00000000008B0000-0x000000000095E000-memory.dmp

Download

memory/4440-145-0x0000000000400000-0x0000000000E23000-memory.dmp

Download

memory/4440-146-0x0000000001270000-0x00000000013BD000-memory.dmp

Download

memory/4552-255-0x00000000021C0000-0x00000000021CC000-memory.dmp

Download

memory/4552-254-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5060-251-0x000002B72BE50000-0x000002B72BE5C000-memory.dmp

Download