rms | 0cf2adc7ec598211ec0e4136c5d8ed2034407c9b8e3176dafcd0fe25e5df70f9

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/04/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-12_2be8440faf381104f27b64969c52d82c_elex_wannacry.exe
Size 10.5MB
Sample260412-2kkbsafv4m
SHA256 0cf2adc7ec598211ec0e4136c5d8ed2034407c9b8e3176dafcd0fe25e5df70f9
MD5 2be8440faf381104f27b64969c52d82c
SHA1 0c0b140bb9c5b58cd53d77c05454a6d95b60b841
SHA512 bb3314414e44a9a882e641713c6fbf850048a38f431d83bc3829d9fe60a0a2bbd9ecaa804553d72217f8013e28607b8a07d39d6fd19632a0b3b85f85e7471588
SSDEEP 196608:VDs4/kdaBJdSa5yc/VJWNYps27yN/7cetBIDrq8AUqvD2NpJA/1njl:VhlJcdc9JW+s2eN7CPztqKOj
TLSH
T188B63336F155DE39F29119B3D99A1EB38BC765F10A1C63F783760D00E9AC4836E2C16A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery rms rurat persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Rms family
rms
RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat
Rurat family
rurat

Detects executables packed with VMProtect. 20 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b39f-6.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/920-15-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/920-16-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/920-17-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/920-20-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2840-140-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3572-174-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/files/0x001900000002b3b9-201.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/5020-258-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/1512-260-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/1736-274-0x0000000000400000-0x000000000099E000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/5900-273-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3396-277-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/3396-416-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/920-427-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/1736-429-0x0000000000400000-0x000000000099E000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/5900-428-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/5716-435-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/5900-432-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2028-434-0x0000000000400000-0x0000000000CCD000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Ports\rup	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\rupm\Driver = "ruppm.dll"	spoolsv.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\SET412B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\lockscr.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET412B.tmp	DrvInst.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DC360524FCB17CA471AA95104371FF0363DD4E6C\Blob = 030000000100000014000000dc360524fcb17ca471aa95104371ff0363dd4e6c0400000001000000100000007f9f2d7fcaa7c276777f34b2d1b814ca190000000100000010000000161f985148bff7c49612833d5fb3324a140000000100000014000000d5e355e05991ddbedb828f5e2709fbef124c47a90f0000000100000020000000978d2cb6654668fca6515c9b6ac3fe6571728bba7fcf02f9b584deb0217e811d2000000001000000c4050000308205c0308204a8a0030201020210060d6d4f59f257499a3c0f672517f576300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303331383030303030305a170d3138303332323132303030305a3081e0311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025343310f300d060355040513063039343235383121301f06035504091318313033205368616d2050656e6720546f6e6720506c617a61310d300b0603550411130430303931310b3009060355040613025343310d300b060355040813044d6168653111300f06035504071308566963746f726961311b3019060355040a131255736f7269732053797374656d73204c4c43311b30190603550403131255736f7269732053797374656d73204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100b66f72b87625b06744045b65a2040c660f51e6c86bd0b71e6aa8df5d4e787a4efa71c44657eb4aa494acba3669e240e926652c24bbf7fa69b5a806b418399f8718c5936685f7fbf3fa2a2ee4098c1298c44439e390f29a6043ad6c01e583e5c7d626e5d19a697ace606d8388727ca75ab11f756f1676354143ec6e8cc430da4c8b017bfc84e29f0198ce482732d038442c85f2178576c6fa40484b544cf03ac5e1b1afbdb029fa0ff8525a670a0643e676aac3a7ed06b7a375427bc14f781d37179ed4b1c539a40f39344d3db67a19b78a3858e921bb5fd2591becdcb60b4cbee7d801a070642a765bfdcc28b9bbb7608545497e0d1d739463eca0f83cb235b70203010001a38201e7308201e3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414d5e355e05991ddbedb828f5e2709fbef124c47a930240603551d11041d301ba01906082b06010505070803a00d300b0c0953432d303934323538300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382010100910efba015c340fd85f590655a5c0b4830ee1cc699aa0a5604ff27e07aba60c38a1789a932986797997d5c71fd4c3c6feb83ed673d7abc2bf12a36c04668b8702dcb0423b6d0d334661980426be9722062ea3b16b6e19acc8231d4aa7f7b2463a1ae3590c3f6662a929c380d1534e71a2c90fc01be45fd4e1a81a86799098eaab405ade3d0b5acdbe44ee01bd603517bc0655edbea9a32e521c6d8d58de3c434dc0fe5a06328151dd289ba0c7f19170b5f7be7785a60f9d013a79a9a0c7b662accc89c72902c99e901f8d0b90a772cfa0b2d045181e3b391d6ecbac909d5b4dc13a29b0209f2dfc26d1ac4dc6cd2114798625bc5ac75971d8b5100fba6c6f955	DrvInst.exe

Executes dropped EXE 18 IoCs

pid	Process
920	installer.exe
2840	rutserv.exe
5020	rutserv.exe
1436	drvinstaller64.exe
3572	rutserv.exe
5900	rutserv.exe
1736	rfusclient.exe
1512	rutserv.exe
3396	rutserv.exe
3316	srvinst_x64.exe
4564	srvinst_x64.exe
5608	setupdrv.exe
5984	setupdrv.exe
924	srvinst_x64.exe
792	VPDAgent_x64.exe
4244	srvinst_x64.exe
5716	rutserv.exe
2028	rutserv.exe

Loads dropped DLL 28 IoCs

pid	Process
5552	MsiExec.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AgentRunOnce = "C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe"	rutserv.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4908	msiexec.exe
3	4908	msiexec.exe
4	4908	msiexec.exe
5	4908	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrvui_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.lng	spoolsv.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_df2a10529f1ac50e\lockscr.PNF	drvinstaller64.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.gpd	setupdrv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_df2a10529f1ac50e\lockscr.inf	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.ini	setupdrv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll	spoolsv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.dll	spoolsv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.lng	spoolsv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unires_vpd.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\rup.BUD	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\lockscr.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CF8.tmp	DrvInst.exe
File created	C:\Windows\system32\ruppm.dll	setupdrv.exe
File opened for modification	C:\Windows\system32\ruppm.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\stdnames_vpd.gpd	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrv_rup.hlp	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.gpd	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.gpd	spoolsv.exe
File created	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_df2a10529f1ac50e\lockscr.sys	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rupui.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rup.lng	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unidrv_rup.hlp	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rupui.dll	spoolsv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\stdnames_vpd.gpd	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rup.ini	spoolsv.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\lockscr.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\rupui2.exe	setupdrv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\lockscr.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CF9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui2.exe	spoolsv.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\rup.ini	spoolsv.exe
File created	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CE7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\lockscr.inf_amd64_df2a10529f1ac50e\lockscr.cat	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\unidrvui_rup.dll	setupdrv.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\rupui.dll	spoolsv.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\SET2CE7.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	rundll32.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\New\unires_vpd.dll	spoolsv.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Italian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Polish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ruppm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Korean.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\German.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Czech.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\French.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\fwproc_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.sys	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese-Brazilian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ChineseS.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI22B6.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\c_monitor.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF87379644B2B2F8E2.TMP	msiexec.exe
File created	C:\Windows\Installer\e57f90a.msi	msiexec.exe
File created	C:\Windows\Installer\e57f906.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3DF2B32F2FD0E0B9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4DC2061286056C2B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f906.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2391.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	drvinstaller64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\VPDAgent_x64.exe	srvinst_x64.exe
File opened for modification	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\VPDAgent_x64.exe	srvinst_x64.exe
File created	C:\Windows\SystemTemp\~DFB517D76F7872BA7E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-12_2be8440faf381104f27b64969c52d82c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
568	PING.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	drvinstaller64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	drvinstaller64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	drvinstaller64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Remote Utilities Printer = "winspool,rup,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	drvinstaller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\PackageName = "ConnecTech's Remote Agent_mod.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\ProductIcon = "C:\\Windows\\Installer\\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\69D8E2116F02BC141A2F0C3E9ADA3DEB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69D8E2116F02BC141A2F0C3E9ADA3DEB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69D8E2116F02BC141A2F0C3E9ADA3DEB\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\PackageCode = "C9F5E2938B8D4E7498061C3C297F062E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69D8E2116F02BC141A2F0C3E9ADA3DEB\Version = "117055296"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
568	PING.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
920	installer.exe
4908	msiexec.exe
4908	msiexec.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
2840	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
5900	rutserv.exe
5900	rutserv.exe
5900	rutserv.exe
5900	rutserv.exe
1512	rutserv.exe
1512	rutserv.exe
1512	rutserv.exe
1512	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
5716	rutserv.exe
5716	rutserv.exe
5716	rutserv.exe
5716	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4612	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4612	msiexec.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeCreateTokenPrivilege	4612	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4612	msiexec.exe
Token: SeLockMemoryPrivilege	4612	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4612	msiexec.exe
Token: SeMachineAccountPrivilege	4612	msiexec.exe
Token: SeTcbPrivilege	4612	msiexec.exe
Token: SeSecurityPrivilege	4612	msiexec.exe
Token: SeTakeOwnershipPrivilege	4612	msiexec.exe
Token: SeLoadDriverPrivilege	4612	msiexec.exe
Token: SeSystemProfilePrivilege	4612	msiexec.exe
Token: SeSystemtimePrivilege	4612	msiexec.exe
Token: SeProfSingleProcessPrivilege	4612	msiexec.exe
Token: SeIncBasePriorityPrivilege	4612	msiexec.exe
Token: SeCreatePagefilePrivilege	4612	msiexec.exe
Token: SeCreatePermanentPrivilege	4612	msiexec.exe
Token: SeBackupPrivilege	4612	msiexec.exe
Token: SeRestorePrivilege	4612	msiexec.exe
Token: SeShutdownPrivilege	4612	msiexec.exe
Token: SeDebugPrivilege	4612	msiexec.exe
Token: SeAuditPrivilege	4612	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4612	msiexec.exe
Token: SeChangeNotifyPrivilege	4612	msiexec.exe
Token: SeRemoteShutdownPrivilege	4612	msiexec.exe
Token: SeUndockPrivilege	4612	msiexec.exe
Token: SeSyncAgentPrivilege	4612	msiexec.exe
Token: SeEnableDelegationPrivilege	4612	msiexec.exe
Token: SeManageVolumePrivilege	4612	msiexec.exe
Token: SeImpersonatePrivilege	4612	msiexec.exe
Token: SeCreateGlobalPrivilege	4612	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1736	rfusclient.exe
1736	rfusclient.exe
1736	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1736	rfusclient.exe
1736	rfusclient.exe
1736	rfusclient.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
920	installer.exe
920	installer.exe
2840	rutserv.exe
2840	rutserv.exe
5020	rutserv.exe
5020	rutserv.exe
3572	rutserv.exe
3572	rutserv.exe
5900	rutserv.exe
5900	rutserv.exe
1512	rutserv.exe
1512	rutserv.exe
3396	rutserv.exe
3396	rutserv.exe
5716	rutserv.exe
5716	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 920	5036	2026-04-12_2be8440faf381104f27b64969c52d82c_elex_wannacry.exe	79
PID 920 wrote to memory of 4612	920	installer.exe	80
PID 4908 wrote to memory of 5552	4908	msiexec.exe	82
PID 4908 wrote to memory of 2840	4908	msiexec.exe	83
PID 4908 wrote to memory of 5020	4908	msiexec.exe	84
PID 5020 wrote to memory of 1436	5020	rutserv.exe	86
PID 4852 wrote to memory of 5620	4852	svchost.exe	89
PID 5620 wrote to memory of 764	5620	DrvInst.exe	90
PID 5900 wrote to memory of 1736	5900	rutserv.exe	93
PID 4852 wrote to memory of 5200	4852	svchost.exe	94
PID 4908 wrote to memory of 1512	4908	msiexec.exe	98
PID 4908 wrote to memory of 3396	4908	msiexec.exe	99
PID 3396 wrote to memory of 228	3396	rutserv.exe	101
PID 228 wrote to memory of 3316	228	cmd.exe	103
PID 228 wrote to memory of 568	228	cmd.exe	104
PID 228 wrote to memory of 4564	228	cmd.exe	105
PID 228 wrote to memory of 5608	228	cmd.exe	106
PID 3396 wrote to memory of 1960	3396	rutserv.exe	107
PID 1960 wrote to memory of 5984	1960	cmd.exe	109
PID 1960 wrote to memory of 924	1960	cmd.exe	112
PID 1960 wrote to memory of 4244	1960	cmd.exe	114
PID 4908 wrote to memory of 5716	4908	msiexec.exe	115
PID 920 wrote to memory of 4368	920	installer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-12_2be8440faf381104f27b64969c52d82c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-12_2be8440faf381104f27b64969c52d82c_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ConnecTech's Remote Agent_mod.msi" /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B9EF48D3DD32EF7DF1A019CCB1A4FD41
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5552
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2840
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -dispinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe
    "C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe" -dispinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    PID:1436
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /printerinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe stop
      4⤵
      Executes dropped EXE
      PID:3316
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:568
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe uninstall
      4⤵
      Executes dropped EXE
      PID:4564
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
      setupdrv.exe uninstall
      4⤵
      Executes dropped EXE
      PID:5608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
      setupdrv.exe install
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5984
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe install
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:924
  - - C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
      srvinst_x64.exe start
      4⤵
      Executes dropped EXE
      PID:4244
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5716

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3572
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -second
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray /user
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.inf" "9" "4351f1d4b" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\remote utilities - host\monitor\x64"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{9EFA7702-E48B-4276-99C3-64BAC9F61BF6} Global\{0143E719-5C8B-4D4F-8BC8-29174C413E89} C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\lockscr.inf C:\Windows\System32\DriverStore\Temp\{de2cf83c-bfa0-b148-bb30-d6236387fe49}\lockscr.cat
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:764
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "DISPLAY\RHT1234\4&27B1E55B&0&UID0" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca116f85e4ac:Driver_DDI:2.30.10.517:*pnp09ff," "4351f1d4b" "0000000000000180" "8b96"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5200

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2040

C:\Windows\VPDAgent_x64.exe
C:\Windows\VPDAgent_x64.exe
1⤵
- Executes dropped EXE
PID:792

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57f909.rbs

Path C:\Config.Msi\e57f909.rbs
Size 25KB
SHA256 3335409fd768b1f65393c8486c2e48f0b8e602f5ec0f10655bc7e3f52794cd51
MD5 b3b41d808f5fe68e089b791a2f6d396f
SHA1 a16c0f6dc687bf63b57f3306f236a453a02da277
SHA512 0588e6f187ac44578c516e0ef68fe96de00e6e51b440fa4cc1a38584fffc98c497df935579f957eb976f584079ad306f45864580edb5f3efa337939106155b29
SSDEEP 384:ckytototiGzj8Fsp4LlznHLsDyOGemKmm/oOwO8N8wQ9kP:c1tototiaj8FGCnr9cmKuLO6n6kP
TLSH
T1C1C2B670AB46C9C2FA0156BB7B4B2E153332970A639C0E1311DC5B249FD5F98792CA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arabic.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg
Size 43KB
SHA256 4dc45baa86597a4c3d08b8297a7cd621e57089390837c3b1ef875393b34d2bf6
MD5 8e66ace6092bd48466784fec9bc3648b
SHA1 98ae43d49ebcc409d704b4bd6a3a3b2c508046ec
SHA512 cccf9e14ff4d35b0f08b80a5ca8684b5feaf2677769154ff5e9a9122683787984750913768605375c1bbe23c20ff88e0193aa62dbd5bf1a738b759f44438ca48
SSDEEP 384:dco05bqFIFdwqqwLv93XWjND9m+JhXC2leaAk4mcr3LeNKqDhQVto2vP:ced03GjTNXCHmS
TLSH
T1AD13F60167ECD238B1FB5B94DABAC0524636BCADDCFCD33D12A6041D26A0A50895B7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChineseS.lg

Path C:\Program Files (x86)\Remote Utilities - Host\ChineseS.lg
Size 33KB
SHA256 0137cc6245a8dcf82c1b8100fe2c90ecb19ec263f01009082885b07f125540ea
MD5 1b1fb5d5b3a34199682b381826128d10
SHA1 49862566b76aab47e365bcdf1993b3c542fd0a2d
SHA512 d8e207e5a912e4e4f4b874abbd14362d6806941066f5a78283fa47543a73947bf786e4b119c8557c9b2093a32cb465a6db314fdb0aaa1e412c1ddfd0fb850dce
SSDEEP 768:WVMFFADmoLiDIDQMj89L8yGu7Vk1cwDy88FXe6nMAhTi:AMFGmoLegy9Qcw211eh
TLSH
T191E2C54273FD5604F5FB5B84E9BED0904A7ABCED982CC75C11D6001D66A0F8198A3BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChineseT.lg

Path C:\Program Files (x86)\Remote Utilities - Host\ChineseT.lg
Size 33KB
SHA256 d47fe430e4414f1285f67d93ee5ec1b6cb5f8c89b126b5558f97165579018f45
MD5 a5de798ae043119dcd1f469ccaa93d83
SHA1 8cbf1b02f0c22eef305b1a00f2cf06fcc2d1e107
SHA512 87816f770a0d8568dc68d939e1504ba6156e643e560c4b8f610e143b7bbe7d729c4b0f6595cdc2f6e3fa1aa8fc4334aa6192a2d78a6e467b429c12025a63f7e9
SSDEEP 768:a1+ETHK+sGpCc9MH2Kp/nWhs3exPm/jxQ:a1IHPg
TLSH
T1DBE2A44133FD5204F1FB5BC4E9BA90944A7BBCAD992CC76C21D6041D66A0F8198A3BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Czech.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Czech.lg
Size 47KB
SHA256 debf4286d7548ec59eccae0d86d3e735b14a895d85e3efacfe3b37e94ebb4316
MD5 9f2fc2133731272cbf022300b3cb32f6
SHA1 7632ee3a7b329d7c509298c298a61c2532701ed0
SHA512 58577a50e405b556e42351e35a02d3fe536f032c52fe4682d5e4fa7d4fe0abd60d02ca513672fd9bd54046e840c2d7e964b90ee322f9a59906b29e1fdfbc7075
SSDEEP 768:tf//yb9l2drALQOxBZvnB8YNyY5cRvz+XId4ZrNijvK7hXov3dos7eOUa7WsIBYq:tn/yb9l2drALQOxBZvnB8oyY5cRvyXH/
TLSH
T1CA23E60233FC5244F1FB5F85E9BA85B54A7BBCE9A938C35D51C2015D1AE0B81C8A27B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Danish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Danish.lg
Size 46KB
SHA256 1dd3dbe1bc8a0fe7bf63abbdeb78f5e8fd86b3e03f23495cb4ccea79308e7cae
MD5 1760c67e9e696c2a21efc2e6af49fd87
SHA1 f0d9317093b5d90a9721bf08689c427e79081f05
SHA512 cf2595532a285c617dc5333928d9217ebc0e4c06c1f28f742b29ec3ee9cb3d55fd86d612e99540dc4c59e2c6d094027efa3879333d846647d8445f76fcb0bf81
SSDEEP 384:PtrzZsqit0gTnYIUMrYShfJFQWYsdFiKAXr4YdI/e:LWTb9fJFVad
TLSH
T1B423524223FD5208F1FB2B84FDBA91A44A76BCEDAC38C71C1191045D59F1B95C8A2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dutch.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg
Size 47KB
SHA256 8a9475ac44cda25fa749b814cbe5c2837326b8f1565e0dfbdbf79cd6bfdb99be
MD5 c5b854838dba2e259b0216a89ce8d50f
SHA1 863442944210d40654b336685a51e8542b95c56d
SHA512 cf6b92e67299b329d2f15525178e8c13f088570d75c484b4986834d5078d962c49f5387554ee7cfc3484cc25921f32282a230fdddf40d2e857d8fd9865205789
SSDEEP 384:01U4rEDbkNbM4W3cBSAPbktNj+5BFED/dSWLgosQBQGZV+vSLDg4D7RbKu2oX6e+:01AANsmbkq5BF+F/5yWj7Ree+J
TLSH
T1E223604223FD5208F5F72B84EDBA90A04E76FCE9A838C75C1291115D56F1F818DA2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lg

Path C:\Program Files (x86)\Remote Utilities - Host\English.lg
Size 51KB
SHA256 9c33c7021de668c3752a12097af14869ab9ac18c75802562ab29b001a3d1037a
MD5 b9cbc2c695c98c1db36fb0a70d7659fa
SHA1 720d03fdc3661bbbff1aae04ff45fe183ce8f0c0
SHA512 95de152b9040265232a26c316009e53ab1664584cf711c9ae0fe34f79986842ed00b68a0f5f87272c67a7dde68ae2aa9e6f45aecd69d2f33fb5d67a934aa7c87
SSDEEP 384:dKrjRalS4EE/1NPsnYQO0NftWGbBJCsFwmlevDYsOUKVPJTs1TqD:A20YGbvllevq3
TLSH
T16433EE4263FD5204F5FB2F84E9BA90644E76BCA9AC38C65C1192015E56F1F81CCB2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

French.lg

Path C:\Program Files (x86)\Remote Utilities - Host\French.lg
Size 49KB
SHA256 c771abe02aa0a0d6cbe37ba09b62ba4ec17195c85c2f11af13555c48afa5fcd2
MD5 84d6b9987b7e52e32cb230856df57487
SHA1 0f544792675ef0993022768594f2c8b051dfd83e
SHA512 9273923c2e4545a2f48f2b00c3f22f7426a523a6347f63ae066b828b6d853de4791a143043714e388ca1b7fa40ad2c0809dd3041dcb5e36c007db90d7b9bf6e7
SSDEEP 384:+RrMmiBP5iLtGu8RNtk6Yf9eXbbkyffdE0YzMKEfyyDwYGlk8:Ko3kuXbbkEFZo
TLSH
T107333C5263FD5205F6FB6F84E9BA90604E77BCAA9C38C21C1292015D59F1F40C8B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

German.lg

Path C:\Program Files (x86)\Remote Utilities - Host\German.lg
Size 48KB
SHA256 e5358640906c61b3474a6cf803dd967d0e3c576dfd6368646f6e09a5acb4a431
MD5 14d228712681b346e3910d72ad337d0c
SHA1 e13b71686e0887d3cfd6a6bacbe0e8c345f2602d
SHA512 3b3c9a1760a1042295f529344d0904f08edee43d1ac946e04eb55e49c767b1bb90da7edad5d51868842c6624efd5c741227b7a3794bcdf3769870c075242fea2
SSDEEP 768:laip7MdAZJplv/lhU7qGQEk1w3MrvP7z4M:lai1MdApxeQEk1w3QvPfp
TLSH
T1E423715223FD5218F6F72B84EDBA91A04E77BCEDA838D75C1281015D56F0F818862BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hebrew.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg
Size 40KB
SHA256 a6623f691d947be4327b53662af986827aeeba497a07cdba5224402ae55b5fd9
MD5 f1c253bcdb334df95b4016f0994fc172
SHA1 c4185b62278dcba8fed32f4c9ffebb1b0b91daac
SHA512 3868ca19f158dc4c4feeca67940b9b82db042d9f80bb3336f4ef027f5588dcd598eb7d007dba63020266a347b438694f2467502f60fe776a84857ca5b939d05e
SSDEEP 384:OPDhf5xV4iMn3w1WrND2mJ9NyqkTeF5UBKtafmjr:KxCrB9yBS9f
TLSH
T15E13FD4133F8D248F1F79F81E97A90594A76FC9C983CF31E21CA006D16A5F81896A77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Italian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Italian.lg
Size 48KB
SHA256 01ba730325b4807b877ca64db8aec1fc261cfd24b6cee0b55519194d29f2da98
MD5 62bae9a3b61257771bc4487774d03392
SHA1 cf64d7012fdbb662257508a9cab7b77808c78716
SHA512 2b29df2eb014d26644c5c4d60dc3c11a122caaa0119a266b560b111987695e2fedcd1e19e9aa2eec30eb303688d0ab9e2602536845cabbeda652691866ed77f6
SSDEEP 384:qctvgaddbrytAD70jotX+pl+GWrPvKk/p+w9ObSKyq/4m6T70wFEKFQ1BYe+0EeG:qNJCKpzRy/m6TAMQzEeG
TLSH
T1F2235E5273FD5208F1F76F84E9BA90644E7BBCA99C38C26C1192006D16F0E51C8B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Japanese.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg
Size 37KB
SHA256 907db401f73584e1666de9bb31cc65eaf4c0955e8c4319f5eeb2aa7c0bf5692f
MD5 9babe747f46d23a8dfdefba63adfc470
SHA1 1dd1c5c9b1151168204c71492d5689d8fa53d995
SHA512 5e7ffa0f9fe941f892b9aaedeb642a1cd7ec68a9a32575edc657a9cbf81f1af6a6b7d6b36abcca51d03a5baa767535b3e24e8f7eee15f2b020f10ea537dbda80
SSDEEP 384:82L4CO6ErQiZDR4uZ+C5y5wnTvjADwkU13Aou9WhoqfcwWmKx5/zw9w:3KQiZDR4ohTbAUF3AdUSGohEG
TLSH
T19103E94133FD5208F1F71B94E9BAA0944B7AFCAD983CC75C11DA041E66A0F8589A37B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Korean.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Korean.lg
Size 36KB
SHA256 84f90a4dde8abfb48f1b6a2601952861a85df0cfb2ae1f2e27435b47534a8f06
MD5 6a02429f647df9b53fb7fa02e289da75
SHA1 2ad17e95a4b91f36a9eb22a98a9fdbac96d602a3
SHA512 8cddaf8fc1782769875fe21e1070085c85773ff84ce2fe51bbdc1f8f8577f4ecdcc1d92c93f5cb4c2bd3478a8d1aaf28b5e2e120ecbbd111f91348e66d5c01eb
SSDEEP 384:sGW11Q9PjdSsr67i13bA35dOAXJs5Etpbp4255R7FKFwGBD:fP5luCAX/pbpNRc
TLSH
T1EFF2D74133FD5244F1FB1B84E9BA90A14A7BBCAD583DC75C22C6015D66A1F81C8A27FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drvinstaller64.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe
Size 218KB
SHA256 2ac061e20210e338ba18736cfffa120a7ec0b33e8afc7372c7aea435932d8777
MD5 ec0e8b2a099b422e8b929840a7bbfdc9
SHA1 9ab9a0116d13f8e78f0f4e50579744ac30bc9807
SHA512 a0177bd48fa3c0fc87d06bad796bd64befbdcadcec4a0dc25a41933fc04372fda6c11972d61d7e380de61947c0395efc5fd633db81ab6cc22d196f9abd0e068f
SSDEEP 1536:rUYAqkUIVQaz5e3fdDJVBbM4L6LG1F33AknTZ9IM3eFyINtiR+uqPXJeyr3XLT5i:VA1UIVuNJ3V+kRsoyrXLTvDLS2Ofz
TLSH
T1C624912762908CABD5AA8139A8D18F38B53FB030432991DB57F1035DCA4BBF18D7965F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Norwegian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg
Size 45KB
SHA256 6e3cc5e24337846c660cfc1e5e2e7ec18a5ec94702dbf1f8ae253fd00a1b07d9
MD5 b0b9aac2125db5ea4b06623900e2e8d6
SHA1 095b8f9326d53ee7d14758c1c0810fcd6993cab3
SHA512 feccad04b242f33a91d1fc311d495c41cf922f7ed91b922e8d5dc0c28ba77c29e2e81a0ebf8c6d0b4e3e91fc397f01bec8eaf277ad6a8cfda064fc9cb520aabf
SSDEEP 768:qtTRW4eWmRs6rRaKpCyRXuxr00wrMoRjkX+6OZn:uBe/ReKpCiuxr00wrMo6X+6OZn
TLSH
T1CF23504223FD5208F1F76B84FDFA91A04A76BCEDAC38C71C1282111D55F1B9589A2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Polish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Polish.lg
Size 47KB
SHA256 c0aa8df31b4f8e796a140159201b6809de077d58bafc6515c368f03cbacc5954
MD5 1c11ddfdccb34efe5fd3201a90b09ffc
SHA1 28421bc35d3d3eaaf10000da6c06e4982ec1acc2
SHA512 b4b1da92e9ae5a0d560887b2cf9bfd1373ad5fdc94e173c1002de7c6dd57995c408d4f658b6c22aa9060b582812531901fcb0c7b212ac49aadcd91b1ae5f02db
SSDEEP 768:5VnHwOrW2UAqBPgjU7IjwQ8AG1Fjy0ojbKNM3wQS:5etB
TLSH
T1D623774233FC5255F5F75F84E9BAA0A44F7BBCB9A938C29D1181001D16F1E81C9A2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Portuguese-Brazilian.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Portuguese-Brazilian.lg
Size 48KB
SHA256 d6c19126bfcea74dd5525ec13cfee394f8124cf3a1af34a84d443d6ea824d419
MD5 f768f95e49c7092e16b0f19b328fe57b
SHA1 8b70ce67074862c79e61cba15f7bffea53d8632c
SHA512 0388775b4ff9cd7c1016d92b938a58e94073ccdb3dbc91d1fb0c1bb38ba74e8e367140090adf510a2bd423924f65c3ab94d497d66f5972d9aecfb1c50b47a6db
SSDEEP 384:yt3sHeDexTUWwWLNGikPDLAi2gaVzi6lqaAhIxKZuX3:YuoZWxDYsi2fVzi6EIL
TLSH
T103236C5263FD5308F5F76F85E9B990644E37BCA9AC38C25C1192016D1AF1F8088B6BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.cmd

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd
Size 68B
SHA256 e71036db28270fff2f386049abcd8b1340f66871c3c6cc64195c4de30d886464
MD5 921adb25b2323226764ccface8bc087a
SHA1 0e657a741ec92704fe2e9b19f7eb0890cba02b1c
SHA512 b91cc962438e4a7afd4324b81d84b3721dc44a49e9c674fa92a5363f8e393ba64bf99aca852b375620d7a4e84a09a8af591df4531346cc936559f80a91cdc999
TLSH
T157A0024D5EFF9031ED182ACC408F3A40CE0308144EC222C0A8EF2528204330E8283303
MD5 SHA1 SHA512 TLSH

Submit Download

rup.gpd

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd
Size 14KB
SHA256 4c21b9663120b494d0f5112eb5f9e0aab4b659a5bf5d5301ee4d5a98abb20f25
MD5 151f3af412abd6bf05d160a70f8873d8
SHA1 0efcf48401d546ce101920496dcbbf3ab252ee87
SHA512 58513727d12cc915cd8445a078beb238aa3df28cc49b3733d487b0d3100f1c519b39f5b809ace618536e2d8951c1b3a58c0763a893bbd92a98c8e06575d92a4f
SSDEEP 384:U1EQCc2g2N2A2X2Y2j2+2BgQzaZah25Dy:3RLormTqdB1aZzy
TLSH
T1E562BD2C39D686CE207FEF36637B2A71F6A51BA790D2982638ACB9344F780155145E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ruppm.dll

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll
Size 62KB
SHA256 ac7df8e319a848ec341ba81de041a0d737ea285e9019726c1e5839754ac4d08b
MD5 9b0583ba26606dcd5d4572bfbb1778b3
SHA1 bce085324e291810b93c8a919d64f37a20338635
SHA512 be471517d4a03022907a242321956cd35bcd335cc707ade8b1a7e1920b89f7b6d17443560a1e2a65deac8b7da7f1b1d07b425e9ea9ecc6096d079ac3561e1410
SSDEEP 768:mVYuFANGodiRkCosD0UjJe3mzslw45MTD9DnQefczpibS/rpay2tbMOxrY578gNU:hQduxw45qhlSTpay2tQNZ3uDkNo
TLSH
T133535B11A7A802ADE5A7CA7491F5472FEAB17C1517248ADF4670CA0EAF33FD29439703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupdrv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe
Size 67KB
SHA256 5b8c7db13921e417cd68d08cc67c4123ca49343ce91ae12026db65a8475ff21c
MD5 1ca27f5b3b86fd332cf6d529e8bf9380
SHA1 f7ff154841f947794bcf6f2721b6be1b567ee9d7
SHA512 791e59cccd4de2e230fcabe93fa653aaf24f32dd00536ba3489107dbd14becf165cb94fa7abbe82b431970dbf199c60255162582939f6d9055e4cb6a55663db8
SSDEEP 1536:zGQUp5qanwouh1hTSoSt7tNqsoZO4AiS5:z7Up5qoGh1pGqfO4A35
TLSH
T1A8633A07BB8D01A5E662CB35D978422BE53A34101BA0EACF96B0C61C8FB3FD5D975B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvinst_x64.exe

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe
Size 42KB
SHA256 5fc38ab7db9ead7c0b415efe327c638a2cb100a6c184e4ed69fdb4e6e5755184
MD5 edf854d77cf309365b7b557c69963cc2
SHA1 9b5f11c443aad2446ce09077b409a3ed89b8d143
SHA512 2e12f78e3710ac33dfce8dd6a5a5efe5ffca46741436d7683e86932f2f5a27516ee0b7b6b056c12d04a9bef5bd89ddb978f651c65a351643733aeb3073f834b5
SSDEEP 768:DSz4Zm+Bz9l6D7cqAyK7Z933JAjcZK04toANY3PKgo:SkHN9HJAjcZnFZ6
TLSH
T1C9130A1A67E90290F972CE75F976022EAE7D385017B0A99F86F0C408CF31FC298A5B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.cmd

Path C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\uninstall.cmd
Size 87B
SHA256 f6ebaa2bc59841b72aaf3c03c7bfea91c75ec1f982f497d6b3d7fb7271cacdf6
MD5 24837286ab8b5537ea3967e0a7905238
SHA1 4f3dc09d2f0c9ede72577154b9954621dd30604b
SHA512 6b0cfd707fbab7034ef45b4864329a9ad01f649216fe13aede6bf6488b50020da65f8a3776c1b125eebe08aef6a848d04a33de8277a2ad3827c8869af1368c00
TLSH
T19EB002465D6BD0359C1D1ECCC58A3540ED5741544B865785DCDF1565504661C8591341
MD5 SHA1 SHA512 TLSH

Submit Download

RIPCServer.dll

Path C:\Program Files (x86)\Remote Utilities - Host\RIPCServer.dll
Size 147KB
SHA256 c1a4af23df4b4630014e7e01704e61b9031fd78eda9352805a56d3e729b42929
MD5 5236fc713d1fd42567d5331ff83ff5e6
SHA1 e58c652a57833cdb04c548149a146a82669edad7
SHA512 45dbe59693e12a20a8b96c43c6b23e08077dabba332512678d555da8b3e6524a31e0a1a11fa237992a1576b16f7ac3e4c8ce059cf8620143276a367a2cc7e877
SSDEEP 1536:5N+2zUKhpXMEvo5JgC61vU+zc2XtAs0NaYuvHlIO6rvkWgYzMDi6N92PPGT/u/PR:H+2YKnMA3ssMJkvRYGT/SZ
TLSH
T1EAE3D712F68D48FBE0D10E79C7B7BD10BB2F7A7F1A32645A1D81861EC69D6421C05A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RWLN.dll

Path C:\Program Files (x86)\Remote Utilities - Host\RWLN.dll
Size 979KB
SHA256 36dde9f3025b18313008b95afbe4dfa5359eccef81b5692b69b14a135e844a2a
MD5 999b47021c31f1b2a7220c04192404aa
SHA1 79801d2556cd3efc4fee562dae1a17768d04ecd2
SHA512 18a325af8d293c8e607757d4aa33f5d1b8709372821bfeb322d9e85a5493fd7446988837d89b1311fd86b58f7b6992b8fe9e7954d0e961545fb0cd9cfa0b58b1
SSDEEP 24576:dFYI4DWFX3nI5xUrrMttp1UF8RNOF9MrQp0AMgB/tvccg4b3Xajdl0zMjK:AITX3nI5xUrrMttp1UF8RNOF9MrQp0Aj
TLSH
T12D253B27B348673AE4B90F390576A5F4587F6B917402CC9E56F44848CEAB2D01E3EA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spanish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg
Size 47KB
SHA256 bf08cecf114a34535c1b06df9675eb8d6b8ce56d925d1d536cb2c3edaa07dcd0
MD5 72dbf6cda53dd026be0ca832806643cd
SHA1 7a884b324ef4b48d9429f7c3f255f0e27d998028
SHA512 a6c2bdc00d6447aa234bc6c8b65dc3d2214e26d2fd5f6f07cb5db63ce1c4d4a06824743c3239eb60555a488c10735239892ec6658a358881326ff5e57f42603f
SSDEEP 384:bhzR6OQzNU8wnP+ft4YgvvmUR2KwzNsGOn46pEkqk6/9VRWhGPLL3wDyXJ+3MBEP:1QxTH9j2ILLBXJ5EFbZ/
TLSH
T11D234C4227FD5205F1F76F84E9BA90644E7BFCA9AC38C21C5292015E1AF0F418C66BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swedish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg
Size 46KB
SHA256 d080ad158a8b083ddccb18f9ea5177bc5da11ab01112b04b14ef3917f8f53d9f
MD5 7f79e44686ec67fa03f5eb2157be0e95
SHA1 b0788205f8e134d4d8bf8b9510da4fdf71f203ed
SHA512 f6528df47bfce981ab8a54e617111667cf10fb39022e05c2718fa767503316b89379319c8a535d7342f47342b470dd739c5f4bd2da936d2e59b63ff7a2c6742a
SSDEEP 384:lZrN8aGiLl0zIV2UYspbDgW5iBNPICyuqwblnXq5r4EMMYY3RhKWIAqfFYBXA6YR:tvtT5iBtICyuqwp65r4VyRlqfuBXAL
TLSH
T1DE23A14223FD5218F6F75B84FDBA90A04A76BCE9AC78C71C1682041D15F1B95C8B2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Turkish.lg

Path C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg
Size 46KB
SHA256 beeb4409dbb580bf5246b2a5739b253513239dca62621a1c9e92041cd223bca0
MD5 2099795cc874ddb6bc22f34f1f6ff8f0
SHA1 fa423d8db42d6dabe58efacc6bd38bf6b9a25800
SHA512 363a7ff773de9ce898b98d8c666e5b66f4c59acccbcfeed5ab313b7506f59c1d554345cb492fbe720e187ee8a6f8205ce6e34808663a0cd1383f3a88c9e9ba73
SSDEEP 768:qjgIfV7cW/3ROD/h9nXXGdKOjvfZTLOjSoegTQ:q1fVoD3nGskvfZTOSoegTQ
TLSH
T15823B55223FD5605F5F71F84EDBA90A04B77BCFDA93CC21E2292005D59F0A918862BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 5.1MB
SHA256 bddfa95b8428fc00de1aa8965a4206e23e0b42453cda2120e078920ee285c967
MD5 7d2aaf066906014ae35dac4e00a9dc4c
SHA1 77309e09f993a14ac5cec024ec9f5af9699e117f
SHA512 eb15d1363c0f08ed0dc13e6dea7673b30e9666c4a59dd38b3bc0cd80e8cb93ff399d30dea2707ea76863a09a6012d1a9dd2e55fff6e7cb0b5d63f693cac9031f
SSDEEP 49152:y0XeyCieTaF4ouS0sNO2b1mSH8Z82VrNuyXXznnQV/TYTlVl9v9JY9870:y4ey66SVZuyXjnQVIvr0
TLSH
T12D368D12B284543BD06B1B3558B7A774D93FBA203A268C5B5BF01C4C8EFA5407A3976F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Size 381KB
SHA256 12d3367d85227176305661fb218c2e16d1d9eb44f5cae0d3278852671feab9a8
MD5 db341183e1224abf99eac3094adfb456
SHA1 a899f5156692ae2389d034d27527d790f093843e
SHA512 7bdd3ffab318ca44949299a384dadf3b3edcaf0950a2f1f60a001a7be5509e9bd43d5f7ac539c6d802ad50e76b9c1a61d007b089ad43e51940b2b650b899fee7
SSDEEP 6144:BIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc7:BI8tiDOzyH9H8Tu6h04fZMZoMPuvfL
TLSH
T1AE846C11A6828131D8FE15B8ACBCEE95222CFE0D9F748DDBD38C294959B21D15634FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Size 1.6MB
SHA256 d73256de77b9175e61a879d427821575925b4c906becc0951cc4b4ce8080dfb1
MD5 2f0ee2662d890f999afd2d642dabbf03
SHA1 0919e17a73b6d4a065406057e2a5f90b6a33c78b
SHA512 12aa9018797237b02bdda8b70e873d93a96756a15ebb0b55532b168bf08e52d2047a07df50baf4eebe3854d7a347af723064d1c58e2fc93ea011863d8c0e8859
SSDEEP 49152:0SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww9:0SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSf
TLSH
T140756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Size 261KB
SHA256 76617176e21d3d97b0141f06240600d3ba7388453103e52e2255b151283c3d26
MD5 603e7f3aa5cb17e60b243514ad2d88e5
SHA1 3a9edb2075eede21125a4e5f6550c1d99476f57e
SHA512 00d667e59e14da5a05155239fdc6587960c40cca871a8642195e5363938c1167b04c0c9b1a11858dea97d9844e94c5530380a3cbf44faa92f5c64da1a25159b5
SSDEEP 3072:aW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTz:aWSfr7sXSmPDbKPJ6/AsNk+x
TLSH
T1E5449D013684C075E9EF0271987DAB2918BDBD724B64C6CBE7881D4E1E316C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Size 366KB
SHA256 713e711686a687468a8ebae60bf7c2c42390afae806e608479086b128dd7c195
MD5 723fba3735a3aa043af97f23146e2c30
SHA1 bd9ed3fc278f1cfa6e11fb06db5543f7ccf31978
SHA512 28fd8327d70926bc9a9c6c9f18c82f53a477745e2cd3ca1749cdec71058d6ff8a9592062d4f115559b4eb64e07027339bd51cf4d599cde57c009909b46d12161
SSDEEP 6144:oaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtu:UoPH0GgEp0gVd1ValsQXsHu
TLSH
T111847B01B992C57ED8EE017018AC7A4BD97A3A6D0778CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Size 861KB
SHA256 34be39343d13792e68531b393ce368ceef3d911413eb74db6c3f20ac321aa869
MD5 81a002118267fcc903e3cb6c1f65a614
SHA1 1e19def262a902c79eb6188aa255d355039c9d20
SHA512 5b642cc602181a704166bd4d79f3e53a68ac7775bed1a42164d7b72d113ee04ac1fb9fe2aa7dedc02649b252f81c829ea225909989812aaa373c5cd992df7bba
SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNz:hYF+Eyx2lzujtEIYRc1cQmsGa7ONz
TLSH
T14315B213F9929D67D7E8023100A1F5355622BCBCC3E35AF73B8476FD39A69805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnecTech's Remote Agent_mod.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ConnecTech's Remote Agent_mod.msi
Size 8.6MB
SHA256 a3c292a0a1f639fbf66b4d16a5446dff14b610876b2554b8866b47ef0a00e971
MD5 c29672961aa9d433213ca8d7da55a8a7
SHA1 8579a60122ea4573b97bccb4bb415118aa880fe8
SHA512 ae87895cebe6f13f5958d66394f90aab6d7f37475cd350112efc7efceeb0d301dee49ec791402b2a2a5d9b50f4b6b1fa8712efc7f283cd1511a3db56bb84d7dd
SSDEEP 196608:uJY/EgpNjubC84ArZlScl0ysN07CxdkZkAHGjE:Q7gppW/trZgcqysn25Gj
TLSH
T1119623023582C433E58E0631497EA765473EFC239BB284DBB364E96D1DB33D0AA72675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
Size 8.2MB
SHA256 46ab20d59cb05726c59208ad32a02629e9c994099e7762d265465762a5948248
MD5 17cde1da8735b709075feeecd6fd686d
SHA1 0b221a745ca48016ebf2e1735d256ec67295a326
SHA512 c8dfa59e54af48fa8070c93f6174ba8ae588c0d66b2662d7173053aa0f40bbb241029dcfc79a960b8dd6af6654f37168236162072e01fc846a714ec1ecef47f6
SSDEEP 98304:T/3CM4yYHFkGLWQ3MQl4chJjBN0lPRga+wVKvvU3a24ftytn:TKMkHFkIWa8Ka+wVKvsK24kn
TLSH
T1C0867C12B3C4503ED26F0A3A683BA7D8983F7A316A118C4B6BF41D4C4FB5741692E767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI22B6.tmp

Path C:\Windows\Installer\MSI22B6.tmp
Size 153KB
SHA256 756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
MD5 52185b209cfdb02d88b4a40a4bdf0911
SHA1 aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA512 8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3
SSDEEP 1536:Ae5evr0fQtkUlPeG+U+n4PtjrqzN/cWJQaqYAJmmD+e7cKsWjcdlsKc8rlq6W9Eq:AievrFt0KyqmDqFJr+egmKc8rANw+
TLSH
T185E3391137E18070E5EE1A3959789A269B3FBC71DB7489CBB394024E1D70AD0EE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en_server_start_85DB64512C79429FA70AC6C0611579DD.exe

Path C:\Windows\Installer\{112E8D96-20F6-41CB-A1F2-C0E3A9ADD3BE}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe
Size 96KB
SHA256 39af9c9c34ab7b5cdebf16fcdefcf61e709ba231241aa135784411ba0efa8c30
MD5 f097f8b959a6272a0fb73d16a92ef1b0
SHA1 2883941f9109f7bd7f7167b169118b3f6f6a5e28
SHA512 ac7dbc0e0db9bd0dbd5aad8976a8764de8a17eb6dec0d999985867c41f3251f1d5bb04a41c362dbef2ebbdaf3201a77fcf33e8d2fb5a63c2e9f693541c53ccc5
SSDEEP 1536:y1U81ctXdrITHGKhoa+5g0SzIV8Q5B5yx5lJlieaN0:Gjc+mZ5g0SzkB5Q5VqG
TLSH
T1C6A3BF166E83046BF0534930D3F24AF04FFE5C037AD2517FEF84291A2FA16AA5816AF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rup.ini

Path C:\Windows\System32\spool\drivers\x64\3\rup.ini
Size 40B
SHA256 e1113b0f0daa2ce44dcc01dabfd8bdff21630c724a333868c87fb9822e60ebed
MD5 ec01a42770693558a18ba4c72d9ada05
SHA1 484bd82cabc1c6ecc8214b3c8e57258755725d79
SHA512 4144d4445c111f9020107fe68135b1117c7e382bbd56b8bffdee03b9188597554d4878728c69942193e703b1bebbb229c1f825fff520b0833ed8188b6666ef1c
MD5 SHA1 SHA512

Submit Download

rup.lng

Path C:\Windows\System32\spool\drivers\x64\3\rup.lng
Size 25KB
SHA256 7633ce5b3d2f8fea91207cdc1b2252b81606be1b5ffafedd56220cfd07f36c49
MD5 de5b0b40318ceabef85c04260141b039
SHA1 450df0a73f682425f631af1bd8b1960490498427
SHA512 2afdbce31039b77761173a3d8a87970a99b152a97048a8710b0d5b4876bd7602dbbf8b5315fe5f4da69d093871ee59c626198371ccdea6180d7e651b871ac91b
SSDEEP 384:h/0YR3H0kSALpeIoxEZBk/uVBE0P/ReIoxEZBkbLj8eNzPyv:hshEMEw3hsv
TLSH
T1ADC2C726D0CF454B5A3322CD7252930FB62B978EA919C15AB25E4F0A64C491C9FCF93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupui.dll

Path C:\Windows\System32\spool\drivers\x64\3\rupui.dll
Size 27KB
SHA256 c83fbc5d5a71fa77345f887f932d96d8e5663e4f110d57d1adc4c5cd02fb16ed
MD5 7f27fac7b6bce91a090ba77ea040cec4
SHA1 2637b5219038977227af72dc3a4342ace8fb615a
SHA512 5d94c391760f81f3c5e695077543a0334eb1b8d9ee3dd7e27c8e8af93d0b057bcd3dc3a2ef3d585a4f8a78d90c5e2cfa369e085c85b0aedaf6dae48b79111a1d
SSDEEP 768:zDEgAAkx/u2FRVZlSqENE0qmYQNY3PKgiGa:KG2FRVbTENlK0Ga
TLSH
T1A6C2391197E84C06F9B3DA7569F19629AE72B810A770C2EF6230D18C1F767D2C938367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdnames_vpd.gpd

Path C:\Windows\System32\spool\drivers\x64\3\stdnames_vpd.gpd
Size 14KB
SHA256 2835a439c6ae22074bc3372491cb71e6c2b72d0c87ae3eee6065c6caadf1e5c8
MD5 7162d8977515a446d2c1e139da59ded5
SHA1 952f696c463b8410b1fa93a3b2b6dae416a81867
SHA512 508f7ca3d4bc298534ab058f182755851051684f8d53306011f03875804c95e427428bd425dd13633eec79748bb64e78aad43e75b70cc5a3f0f4e6696dbb6d8e
SSDEEP 192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
TLSH
T15252F9A014F0ED5B1A7AC316BC6D8786A269814F03E2E52C735E59760FFF96295E203C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrv_rup.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrv_rup.dll
Size 476KB
SHA256 e48e2df699bb14925d730014e671d1bbf25d886703a5feff8e5b85b1524c3f51
MD5 c4703ad0f4e5d17138a68d3756b0de74
SHA1 40e1d94c295ef16dec421fea094c3e81c5e7e789
SHA512 ab55399d7a0cb6fae06f0f92c71af21ab8c48a2526eef0d718bc1b70b656f08d5041f8c65b387d6a9fd239d47c948c54dbda5e86fe15e0d5ca94be5e6e565fc8
SSDEEP 6144:2gjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvA:2glSTPaRxFdLXyJ/ebEEkx0rqJduO
TLSH
T104A45A4AF76104F5C4ABC074C566DB37EF76B4B910049B474BA2DF722B23BA05A1B326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrv_rup.hlp

Path C:\Windows\System32\spool\drivers\x64\3\unidrv_rup.hlp
Size 20KB
SHA256 0c02b226be4e7397f8c98799e58b0a512515e462ccdaac04edc10e3e1091c011
MD5 6798f64959c913673bd66cd4e47f4a65
SHA1 c50faa64c8267ac7106401e69da5c15fc3f2034c
SHA512 8d208306b6d0f892a2f16f8070a89d8edb968589896cb70cf46f43bf4befb7c4ca6a278c35fe8a2685cc784505efb77c32b0aabf80d13bcc0d10a39ae8afb55a
SSDEEP 192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
TLSH
T17692846A388DC846EB44C27DCAF17BE94D295C718EF09687F9897B0CA830E15E299458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unidrvui_rup.dll

Path C:\Windows\System32\spool\drivers\x64\3\unidrvui_rup.dll
Size 872KB
SHA256 8ce33d61fc06b8f1b81538075b668961d9523e0c2a297def651fcca99f0b441d
MD5 53ef29e6f1e49925e43dddcc49735c7e
SHA1 107405f249c6a9debd9e7da33f003cd1841b8b8c
SHA512 ceb94763081f233ecb69e86c1ddf82e7365eb4754b11120cfbdce416536cae01989b66378f3ef463a87f13776aeeccc70c708a76a9815b2303489216bb94d3ab
SSDEEP 12288:hpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23soL:JZ5F/bYogxJUB9cwtHFMDE
TLSH
T1E2150901A3FA0169F1F3CB7499B58256DE76BCA56B35C6CF0290425E1A32BE0DA35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unires_vpd.dll

Path C:\Windows\System32\spool\drivers\x64\3\unires_vpd.dll
Size 753KB
SHA256 7e11a349d285a014d813734293fc3dc203bbc61f87b99d18fe433293c43123f9
MD5 e4385f8d4b4e7634462e9defac45dc71
SHA1 faf49274511be71d946071d59cd4ac03b27b9a76
SHA512 01a88c33609dba6abfc1b376f32b8a4380b29dec8b19e301e88ad84214342814584494e4ce505c6dc2c7280c0e5a65999577ad2ae388c4555f9b6cc9df0c1728
SSDEEP 12288:+kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLF:SzBEGbL4Np84TQazCSiRF
TLSH
T159F45C2A76FD6E06F6B32A7128F1095735FA7C48837CD72D2280B75C995E7542820FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.sys

Path \??\c:\PROGRA~2\REMOTE~1\monitor\x64\lockscr.sys
Size 15KB
SHA256 7eafec7d9db0f104da13f2c1475ed2b1b07ffdf3e886f3909441aac5262af7cb
MD5 d814c453b59a06daf203440ac6d3a9fb
SHA1 d61b021e9bc99b74543ac41f050d70077d564235
SHA512 562700bb929455f79626cffb3372cbeb8ab67cd7a7d8a9ef8c3f8009414035e084485238b5a4a7b4ab60c943f5594dcd2a0f32e00cd0a7b22961c20336e1cfc8
SSDEEP 192:ULTxu7TS2JivooUOznYe+PjPJdZubhEAq+nuMYrZscF8Bd1Lcb6Hrrs:0lu7YvGcnYPLXZBANYrZsHLcuLg
TLSH
T184622896A765AC83EFA7CE3025E6D5A6BD74F240B751C9DF502AC0944E85FE2353C20C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.cat

Path \??\c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.cat
Size 8KB
SHA256 316478fb7c387609b99dea3382f1e7165e378766289ad8fc31b7e88e0a452c32
MD5 c60b74f8d5df0736cbe3c80d62d29b43
SHA1 365d8e6c77075506e0a0b5622c60b528f6205014
SHA512 e1f194541c9a502e1376b449f0b303de9a12959eb5ad6a69c5050b2f5e06e6d81aa74194e1ba7f347bae4ed2bcfa21a1d9f8e7360a0520024e55aafd639f7e4f
SSDEEP 192:osnYe+PjPJdZubhEAq+nuMYrZscF8Bd1LMlrT6HkVK:osnYPLXZBANYrZsHLMlyHAK
TLSH
T157022A919B595C42EEA3DD6038E5D06BBC71BA92E510C0BE316FC1608FD1FE23AAC15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lockscr.inf

Path \??\c:\program files (x86)\remote utilities - host\monitor\x64\lockscr.inf
Size 1KB
SHA256 a61d4b5134ecf0fc2d5eb660f281b3576aac537ec3d5da852070a6c5373002e2
MD5 d8c3fa104152dfa75bdcb4bd2259714c
SHA1 42aa67541450b0ffc995354417aef0db283a3b6a
SHA512 07c75c369b8ee43a4afc7c67e3542b6ce52625b70b04115ebc5c0b03423c4032faf06f26d9500535c51bc5c05f54d290214bd55e17ce23d8be1ac859863422cf
TLSH
T1BF31777A505B8529B85373367E977642629A300270D49911B0DCC2D0AB7D91CAB362FF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-238-0x000001FEA5530000-0x000001FEA553C000-memory.dmp

Download

memory/920-427-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/920-14-0x0000000000B24000-0x0000000000B25000-memory.dmp

Download

memory/920-20-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/920-16-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/920-17-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/920-15-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/1436-256-0x00000000007A0000-0x0000000000C0C000-memory.dmp

Download

memory/1436-257-0x00000000023F0000-0x00000000023FC000-memory.dmp

Download

memory/1436-255-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1512-260-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/1736-429-0x0000000000400000-0x000000000099E000-memory.dmp

Download

memory/1736-274-0x0000000000400000-0x000000000099E000-memory.dmp

Download

memory/2028-434-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/2040-437-0x00000000025E0000-0x0000000002A4C000-memory.dmp

Download

memory/2040-438-0x00000000016B0000-0x00000000016BC000-memory.dmp

Download

memory/2840-140-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/3396-277-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/3396-416-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/3572-174-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/4908-24-0x00000152A2FA0000-0x00000152A2FAC000-memory.dmp

Download

memory/4908-264-0x00000152A4DD0000-0x00000152A523C000-memory.dmp

Download

memory/5020-258-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/5620-247-0x0000021EF2DF0000-0x0000021EF2DFC000-memory.dmp

Download

memory/5716-435-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/5900-432-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/5900-428-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download

memory/5900-273-0x0000000000400000-0x0000000000CCD000-memory.dmp

Download