rurat | f0d2fb5adec8c9ec713d9115fb4f13ba4175d5e51ae3c378dc8472e1565b1b2d

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe
Size 25.3MB
Sample260722-k87njsfr21
SHA256 f0d2fb5adec8c9ec713d9115fb4f13ba4175d5e51ae3c378dc8472e1565b1b2d
MD5 59c7a1a881fef4192980bac7dfc833a7
SHA1 b93e413ef6ae6f35edad4142a7b7ec0c6e5e5a2a
SHA512 f075b889ec26b8f0f285a42c47b978d200ad701e9d43af232aaa0ad75f361b8278c43abee0d4f43a0d03cf209b9bd5a1e76c2187d17ddf27f174c675a93d2d11
SSDEEP 786432:YjSlpLt7wZ6MNIz+rpHw+WHEcWUs+fmVMrk:aKz4Iz+rVw+WkcRsR9
TLSH
T1D8473359C7556AB5E17393708C1348ABEB7338588360E57FA36859183F23E33B639392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery rurat spyware trojan

Malware Config

Signatures

Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat
Contacts a large (520) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Executes dropped EXE 10 IoCs

pid	Process
6040	rfusclient.exe
260	rutserv.exe
4724	rutserv.exe
5388	rutserv.exe
3648	rutserv.exe
3096	rutserv.exe
1888	rfusclient.exe
4728	rfusclient.exe
4680	rfusclient.exe
3420	rutserv.exe

Loads dropped DLL 11 IoCs

pid	Process
1208	MsiExec.exe
6040	rfusclient.exe
260	rutserv.exe
4724	rutserv.exe
5388	rutserv.exe
3648	rutserv.exe
3096	rutserv.exe
4728	rfusclient.exe
1888	rfusclient.exe
4680	rfusclient.exe
3420	rutserv.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	6096	msiexec.exe
6	6096	msiexec.exe
21	6096	msiexec.exe
25	6096	msiexec.exe
36	6096	msiexec.exe
37	6096	msiexec.exe
50	6096	msiexec.exe
55	6096	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\licenses.txt	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\e58464b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58464b.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC679.tmp	msiexec.exe
File created	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC416.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7909B304-45ED-452D-A7A6-3C67869864A1}	msiexec.exe
File created	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e58464f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{7909B304-45ED-452D-A7A6-3C67869864A1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000300000001e9d5-96.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\403B9097DE54D2547A6AC3766889461A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\PackageCode = "EF982677F40F8534A904508BC0D34559"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\AuthorizedLUAApp = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\Version = "117964804"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\ProductIcon = "C:\\Windows\\Installer\\{7909B304-45ED-452D-A7A6-3C67869864A1}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\PackageName = "21.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\403B9097DE54D2547A6AC3766889461A\RMS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\403B9097DE54D2547A6AC3766889461A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\403B9097DE54D2547A6AC3766889461A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
6040	rfusclient.exe
6040	rfusclient.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
4724	rutserv.exe
4724	rutserv.exe
5388	rutserv.exe
5388	rutserv.exe
3648	rutserv.exe
3648	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
4728	rfusclient.exe
4728	rfusclient.exe
1888	rfusclient.exe
1888	rfusclient.exe
1888	rfusclient.exe
1888	rfusclient.exe
4680	rfusclient.exe
4680	rfusclient.exe
3420	rutserv.exe
3420	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5852	msiexec.exe
Token: SeSecurityPrivilege	6096	msiexec.exe
Token: SeCreateTokenPrivilege	5852	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5852	msiexec.exe
Token: SeLockMemoryPrivilege	5852	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5852	msiexec.exe
Token: SeMachineAccountPrivilege	5852	msiexec.exe
Token: SeTcbPrivilege	5852	msiexec.exe
Token: SeSecurityPrivilege	5852	msiexec.exe
Token: SeTakeOwnershipPrivilege	5852	msiexec.exe
Token: SeLoadDriverPrivilege	5852	msiexec.exe
Token: SeSystemProfilePrivilege	5852	msiexec.exe
Token: SeSystemtimePrivilege	5852	msiexec.exe
Token: SeProfSingleProcessPrivilege	5852	msiexec.exe
Token: SeIncBasePriorityPrivilege	5852	msiexec.exe
Token: SeCreatePagefilePrivilege	5852	msiexec.exe
Token: SeCreatePermanentPrivilege	5852	msiexec.exe
Token: SeBackupPrivilege	5852	msiexec.exe
Token: SeRestorePrivilege	5852	msiexec.exe
Token: SeShutdownPrivilege	5852	msiexec.exe
Token: SeDebugPrivilege	5852	msiexec.exe
Token: SeAuditPrivilege	5852	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5852	msiexec.exe
Token: SeChangeNotifyPrivilege	5852	msiexec.exe
Token: SeRemoteShutdownPrivilege	5852	msiexec.exe
Token: SeUndockPrivilege	5852	msiexec.exe
Token: SeSyncAgentPrivilege	5852	msiexec.exe
Token: SeEnableDelegationPrivilege	5852	msiexec.exe
Token: SeManageVolumePrivilege	5852	msiexec.exe
Token: SeImpersonatePrivilege	5852	msiexec.exe
Token: SeCreateGlobalPrivilege	5852	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe
Token: SeRestorePrivilege	6096	msiexec.exe
Token: SeTakeOwnershipPrivilege	6096	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4728	rfusclient.exe
4728	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4728	rfusclient.exe
4728	rfusclient.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
6040	rfusclient.exe
6040	rfusclient.exe
6040	rfusclient.exe
6040	rfusclient.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
260	rutserv.exe
4724	rutserv.exe
5388	rutserv.exe
5388	rutserv.exe
4724	rutserv.exe
5388	rutserv.exe
5388	rutserv.exe
4724	rutserv.exe
4724	rutserv.exe
3648	rutserv.exe
3648	rutserv.exe
3648	rutserv.exe
3648	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
3096	rutserv.exe
4728	rfusclient.exe
1888	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
1888	rfusclient.exe
1888	rfusclient.exe
1888	rfusclient.exe
4680	rfusclient.exe
4680	rfusclient.exe
4680	rfusclient.exe
4680	rfusclient.exe
3420	rutserv.exe
3420	rutserv.exe
3420	rutserv.exe
3420	rutserv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 5852	4744	Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe	85
PID 6096 wrote to memory of 1208	6096	msiexec.exe	102
PID 6096 wrote to memory of 6040	6096	msiexec.exe	103
PID 6096 wrote to memory of 260	6096	msiexec.exe	104
PID 6096 wrote to memory of 4724	6096	msiexec.exe	106
PID 6096 wrote to memory of 3648	6096	msiexec.exe	109
PID 3096 wrote to memory of 1888	3096	rutserv.exe	113
PID 3096 wrote to memory of 4728	3096	rutserv.exe	114
PID 1888 wrote to memory of 4680	1888	rfusclient.exe	115
PID 3096 wrote to memory of 3420	3096	rutserv.exe	119

C:\Users\Admin\AppData\Local\Temp\Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe
"C:\Users\Admin\AppData\Local\Temp\Kopiia_elektronnoho_dokumenta.135240.22.07.2026.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\21.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5EBEEE328C6DED492627AAECF8B32AAA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1208
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\21.msi"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6040
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:260
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3648

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4680
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4728
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58464e.rbs

Path C:\Config.Msi\e58464e.rbs
Size 470KB
SHA256 5f9a895f52b83683ba5264f76b82c5593e4be096da68d690918339479acd127f
MD5 c2360cd817672ae1e28935d18aa93910
SHA1 9b2a151f23dd835763ecfa614e00d699b37e6997
SHA512 7a5fceb96228f66203bcd37faf6933154fde42a3652120ee1eaf6dbbe9d45679c5d0f026c1f4df7158e2b353073ab0293dc92118ce699a2b6fae3c6a1e8471d2
SSDEEP 6144:9GH3fm1fZZBiVOy4h4CyzBFrnoxe5QMT+p+26zpLLXM3+0gH/sMnEp3hgqleWudX:9E
TLSH
T1A3A4D628F246C8B9F66F507576ACBF5190B731EB23C89A5430788458E3DAFED4D901E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EULA.rtf

Path C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf
Size 63KB
SHA256 ff89e44b7e6b7c8c9a84c67e40bde6491f851b0e6e4143ac8f665538eec11e87
MD5 d02cab84a0a63deba81054743c18f178
SHA1 87d5a51e150684df9c4f95a685464c4429a6864d
SHA512 7be34ca5836346bed137c507e9a1ca27499e5427aaf3bc6c8c9a1ca090d0ba3a9adbd9e14db38bd31ae85353015dcceebf5881d5380de966872238fd5d772d12
SSDEEP 768:wmgKfqWHXYo8H8ENrwj5XvSFxIu/wj5XvSOb8ON1qbcIHeSOmt7/8jn8l/NLoJ0e:wmgWHIoycbhrqbcqeSOI/8bEHe
TLSH
T1F35385F8014452AAD3A313A16F1AF0C87A3BF92414F5A4E431EFC3FD61BF598D666522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Privacy_policy.rtf

Path C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf
Size 139KB
SHA256 1fcb0c18d74b4157752a5776ca47bf31f893453b4bcb82ba67b402769d054c26
MD5 b6d5dd2e4b2b3163f6bad087aa9f2ba4
SHA1 a9ef4821812d21c6bd93c9bc262494331d8eb130
SHA512 06b30fa94a1177c08dbcdf2251f2e48640bfe6403849d99af5522e0dd6e6978d9d30abc3d1023498b51cd9833ef9dc9845b73310cad2cd29650379f6f7c80b9b
SSDEEP 3072:whBk6AJAB0A0JcfGiYH6kZNUFrgXVbwRdi7mbXUiZmoXYSFRdXvYkifGtGJFbxUm:MS6VFr8pwRdi7mbXUiZmoXYeRdXvYki3
TLSH
T179D3C6B84D4592D5CB6343426ABEF4CCAA39F01005B9B0F572AEC3F980BFD98DD5644A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventmsg.dll

Path C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Size 57KB
SHA256 badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2
MD5 382f1f40ace9eb75f55400d4bea1dbf6
SHA1 94176ea4b9529c377bbdec1cb70458691b2efade
SHA512 3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c
SSDEEP 768:rDb11m1u0/h46F5BHk++oJAj7kqMJSxtr2xnh2END:rVl6hzk++oJY7ku/4hX
TLSH
T122437C13D702C177C51A4AF868B660D59A3B7E611C255EF713EB88F80DDD3836E0E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 9.4MB
SHA256 299b3f5e49d3303e0a4793fee52a1165c340a560729115f1a4d421d6f0416fa5
MD5 5e5d28b2f2bbe4e7cab4e618795e5d2e
SHA1 1518a1ef3060da0b8b37ad3369efc51f65cf93d9
SHA512 7cebf0b9fe348606d3b8cd486a8cd0f9a49111b61a0b84039eb86c7a8fa8782edee87b90d2cd61127e7729b1eff1c096f1d2728e3555031be4d2302ad7d8951d
SSDEEP 196608:FG/Cpci+V7HdwLu9lnSk9MX3AgrzLVvcWP/Rkv4nnPIOulABW0Xz/WEmH2/gqc2d:ImyhTWMWHc2EeJUO9WLQDh
TLSH
T1F7A62955EA8B28F5EE936771818BF33F5734AE00C636EFB7FA08D525A8336821905351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcodec32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll
Size 5.9MB
SHA256 a4a53244ea6bafa55c6f1c4b13da9a6a77e758842593e51b01b34dc137465930
MD5 cada7566aa85b9527028a81fcc335754
SHA1 5aa0ca6b593918773aacf980c1038b0f2b034ce8
SHA512 591a4abcbebb4cb0f9641bedd5f271fd4482317c74ca33fa81dfc0a03cdcd318c6049fa51b6918d43b3bf064070f13f461d00f360d7cf285797352bcc8c2995c
SSDEEP 98304:eWV9pglfgw7i6G6666666666666666666666666666666x666666666666666fwG:eWVklfgw7iEgBon00l67+M
TLSH
T131565C42FACB58E1D8D32BB4519BE33B9738AE15C125DB7BFB48DA15F8633815819302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licenses.txt

Path C:\Program Files (x86)\Remote Utilities - Host\licenses.txt
Size 19KB
SHA256 4ef24da2e7933364af0c7918207927283d0b7664c615b888cc80843d7a62faa4
MD5 11b4de5dc2e474660c966c79bbcc0704
SHA1 b921b50c8e4f68e2cdc76e00bbbfbdf479610b41
SHA512 22e6a9254249647858e5e2c6f324cf0b7dcc9fcad9438453a0b966813f14102fb73bc9c40a037da9a1edea6c1f4ebca4ab71e69219730dd57affaa0ed9c83512
SSDEEP 384:8vGt7E1Onas/O5yo0tkKXsl8rsxrsHbpeeYgr3rNajA8JjNwrFNrsmrsMdxeeYgP:81OnasW5ybkVyy9eYgb38JpwBNhPkeY6
TLSH
T1B092D86F734903731AE202A1764BA8C9F21E903C3B6B2A14305DD15C237BA2997B759D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 17.0MB
SHA256 e4b203c315f44799e4945c3b95501b9bf5480bda5ff596dadbfebdb39996020a
MD5 d16b0cd78efd9b5bfb947d8bff492a7d
SHA1 4436c5fd8fb93877594c117141c9522f6e708387
SHA512 ad349d928054a2d00a4ff5ebe5ddb8f6035a166db40e62124b667dd9f84d4b3503a493d78c0183859111c3eba69e1be9b2fc8496142a7d0f81432f27245ace20
SSDEEP 196608:T8LszoGlK0/vJCMEF1EhB5CKvQ7ZVVMAko5QgE4YH86E:TUsHlKAvJCLF1EhB5CtZV+wQg286E
TLSH
T1FE078D03B284643FD06B1B3A5937EB64593FBEA12A12AC1767F8794C1F356802D3B647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 21.7MB
SHA256 6fc8237bbb1cb778bf7735fd92963cd1f95acd44e7c987c40e9349ed5be85327
MD5 64587e43808cedf731fcff0fc907468f
SHA1 a819d960423662b3c324d88cfcbf9f69d5c1e2c8
SHA512 137e56a87fa680c3530f6a917f365251d5f2e8c18fc943da337baaeacf9fa6d0f45aad080ec634eeed8e9da9afcbff2e82fcc1ba431d45ccbb9072b6af65aece
SSDEEP 196608:E+FI3Dq0OprjRMKUJVY94DFPxA3bQyUYY9XQDig0RRIeaclqtrUu7OtltW:NITq0OrjRMdVrDFPao9gjqeclq+COtzW
TLSH
T176378E03B684953DD09B0A3B5C3BE6A4AD3F7EA12A168D0767F4398C5F355813E2B247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Size 384KB
SHA256 851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718
MD5 8e643fba05dbd17e52b0f57930a2b759
SHA1 55e11d1cc910700da3a35ba55dc2985f3795c4be
SHA512 266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6
SSDEEP 6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwch:EI8tiDOzyH9H8Tu6h04fZMZoMPuvfR
TLSH
T157847C11A6828131D8FE05B8ACBCEE95222CEE0E9F744DDBD38C294959B21D15774FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Size 1.6MB
SHA256 1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400
MD5 e58922447d2d0a9c007ccdca2a37cd81
SHA1 56dfa225585db1e31bea28a8225dfce18a4c0625
SHA512 cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82
SSDEEP 49152:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
TLSH
T16E756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Size 264KB
SHA256 1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4
MD5 696b0057893c38580911c0579a9909b0
SHA1 59c22298a5c37ca26999acac9e16822247cdfc47
SHA512 38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b
SSDEEP 3072:XW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTg:XWSfr7sXSmPDbKPJ6/AsNk+Dy
TLSH
T1B1448E013685C075E9EF027198796B6A18FCBD724B64C6CBE7881D4E1E312C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Size 369KB
SHA256 2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de
MD5 170c0540946feeb20199d9a594e11879
SHA1 ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd
SHA512 33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa
SSDEEP 6144:qaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtwl1:yoPH0GgEp0gVd1ValsQXsHy1
TLSH
T1BE848C01B9A2C57ED4EE017018AC7A4BD9793A6D07B8CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Size 864KB
SHA256 f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721
MD5 7a8acedc516cc199f7b56ca09def1ab0
SHA1 f0579f76bae11358f4efa0d4a2aa46a7c667865c
SHA512 5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f
SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNd:hYF+Eyx2lzujtEIYRc1cQmsGa7ONd
TLSH
T18915A213F9929D67D7E802310091F5355622BCBCC3E35AF73B8476FD39A6A805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21.msi

Path C:\Users\Admin\AppData\Local\Temp\21.msi
Size 27.6MB
SHA256 70eada83d62a7aeb27c5952fe0a85cdba9c2e85b9cbeb0dd127e7b0d6bac5a7f
MD5 1c646bf437d33417ea7314d33f8094be
SHA1 1802499df74718ac84fce34312eb0f22ba9dbcb7
SHA512 5f8a9d5738bc170fcb82921dc3573a719ef9abfc7e59753989231551bb67a3bef384ae110ee3424615078d33b56921d9ecbb7597a822965c7175a2336afe89cb
SSDEEP 393216:0p1s7O5Sz3ds708J/LrRQLJg3g9DGH0bpZlJjfFx3O1lP1IbVmTovfYwOv4QS0V:S1qNgBQL+3g9DGHWjdxyIbVo
TLSH
T18B571285F651886AFA5F0231A6FABF08447BFCFE13D4624934E8B119A2E3ED50D520D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC416.tmp

Path C:\Windows\Installer\MSIC416.tmp
Size 165KB
SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
MD5 b5adf92090930e725510e2aafe97434f
SHA1 eb9aff632e16fcb0459554979d3562dcf5652e21
SHA512 1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509
SSDEEP 3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
TLSH
T182F3281177E18030E5EF1A3A69749A264B7F7C72CB7489CBB384464E1D70AC1AE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-122-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/260-121-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/1888-167-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/1888-168-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3096-213-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-206-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-219-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-195-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-164-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3096-163-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-226-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-188-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-174-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3096-181-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3420-203-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/3420-204-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3648-160-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/3648-159-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/4680-172-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4680-171-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4724-130-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4724-129-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/4728-201-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-192-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-170-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/4728-185-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-169-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-178-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-210-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-217-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/4728-224-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/5388-127-0x0000000000B20000-0x00000000021A0000-memory.dmp

Download

memory/5388-128-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download

memory/6040-99-0x0000000000AD0000-0x0000000001C85000-memory.dmp

Download

memory/6040-100-0x000000006D280000-0x000000006D9B6000-memory.dmp

Download