Analysis
- user interaction
yes - max time kernel
146s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe
- Size 29.7MB
- Sample261104-rblhdadf72
- SHA256 28c4386ec07652a9aa692e89065ada8925096e739ac6478601dbab198fba9a42
- MD5 82c798157c3c18c010f5daf14ebd2448
- SHA1 d493d61f75f370fb555c16c76300f0bc4c7b8a2c
- SHA512 9a45082c539ff706855e6fe3f10d03124ecbdeda3851aca2b31ac77d6560b460fdfd2752b3e04106f3b4a1e8ce67684eae65d74add117dd8cbfd4d7b68f3d778
- SSDEEP 393216:0qgaAdUcRIhGwIo9B4n8qVbHC3WxOLwZhNRbh5mL1mlJZVTae2DEdwcyKpxCxlrO:0TaAd1IA5os6WELuRdVlJZJB+t9IC/Ty
- TLSH T1A467331AF284BAEAC53A5578CFD41811F573B8CE47F16BDB13A40CA58EB3E506D36212
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation rutserv.exe Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation rfusclient.exe - Executes dropped EXE 10 IoCs
pid Process 4196 rfusclient.exe 1564 rutserv.exe 4752 rutserv.exe 1748 rutserv.exe 3296 rutserv.exe 1540 rutserv.exe 4128 rfusclient.exe 2504 rfusclient.exe 4396 rfusclient.exe 4332 rutserv.exe - Loads dropped DLL 11 IoCs
pid Process 1424 MsiExec.exe 4196 rfusclient.exe 1564 rutserv.exe 4752 rutserv.exe 1748 rutserv.exe 3296 rutserv.exe 1540 rutserv.exe 4128 rfusclient.exe 2504 rfusclient.exe 4396 rfusclient.exe 4332 rutserv.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 1800 msiexec.exe 9 1800 msiexec.exe 13 1800 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_0836302494CC90535066A23E63C0A2F2 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_0836302494CC90535066A23E63C0A2F2 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1 rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E rutserv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F rutserv.exe - Drops file in Program Files directory 57 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\licenses.txt msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico msiexec.exe File created C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File opened for modification C:\Windows\Installer\e588e70.msi msiexec.exe File created C:\Windows\Installer\SourceHash{914C90D4-58B9-5A32-8F83-85D03BA2991B} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9B90.tmp msiexec.exe File created C:\Windows\Installer\e588e74.msi msiexec.exe File opened for modification C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe msiexec.exe File created C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe msiexec.exe File created C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_stop_B603677802D142C98E7A415B72132E14.exe msiexec.exe File created C:\Windows\Installer\e588e70.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI995D.tmp msiexec.exe File created C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\ARPPRODUCTICON.exe msiexec.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x0007000000024312-93.dat embeds_openssl - Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rutserv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rfusclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rfusclient.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rutserv.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rutserv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rutserv.exe - Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\AuthorizedLUAApp = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\PackageName = "e66e696067061f30.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Net\1 = "C:\\ProgramData\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\4D09C4199B8523A5F838580DB32A99B1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4D09C4199B8523A5F838580DB32A99B1\RMS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\ProductName = "Remote Utilities - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Version = "118030336" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\ProductIcon = "C:\\Windows\\Installer\\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\\ARPPRODUCTICON.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4D09C4199B8523A5F838580DB32A99B1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\PackageCode = "A5C3A0D207F69264DA5BE2DC652AF39C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Language = "1033" msiexec.exe - Modifies system certificate store 2 TTPs 13 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 rutserv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 rutserv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f rutserv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 rutserv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 rutserv.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4196 rfusclient.exe 4196 rfusclient.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 4752 rutserv.exe 4752 rutserv.exe 1748 rutserv.exe 1748 rutserv.exe 3296 rutserv.exe 3296 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 4128 rfusclient.exe 2504 rfusclient.exe 4128 rfusclient.exe 2504 rfusclient.exe 4128 rfusclient.exe 4128 rfusclient.exe 4396 rfusclient.exe 4396 rfusclient.exe 4332 rutserv.exe 4332 rutserv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4108 msiexec.exe Token: SeIncreaseQuotaPrivilege 4108 msiexec.exe Token: SeSecurityPrivilege 1800 msiexec.exe Token: SeCreateTokenPrivilege 4108 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4108 msiexec.exe Token: SeLockMemoryPrivilege 4108 msiexec.exe Token: SeIncreaseQuotaPrivilege 4108 msiexec.exe Token: SeMachineAccountPrivilege 4108 msiexec.exe Token: SeTcbPrivilege 4108 msiexec.exe Token: SeSecurityPrivilege 4108 msiexec.exe Token: SeTakeOwnershipPrivilege 4108 msiexec.exe Token: SeLoadDriverPrivilege 4108 msiexec.exe Token: SeSystemProfilePrivilege 4108 msiexec.exe Token: SeSystemtimePrivilege 4108 msiexec.exe Token: SeProfSingleProcessPrivilege 4108 msiexec.exe Token: SeIncBasePriorityPrivilege 4108 msiexec.exe Token: SeCreatePagefilePrivilege 4108 msiexec.exe Token: SeCreatePermanentPrivilege 4108 msiexec.exe Token: SeBackupPrivilege 4108 msiexec.exe Token: SeRestorePrivilege 4108 msiexec.exe Token: SeShutdownPrivilege 4108 msiexec.exe Token: SeDebugPrivilege 4108 msiexec.exe Token: SeAuditPrivilege 4108 msiexec.exe Token: SeSystemEnvironmentPrivilege 4108 msiexec.exe Token: SeChangeNotifyPrivilege 4108 msiexec.exe Token: SeRemoteShutdownPrivilege 4108 msiexec.exe Token: SeUndockPrivilege 4108 msiexec.exe Token: SeSyncAgentPrivilege 4108 msiexec.exe Token: SeEnableDelegationPrivilege 4108 msiexec.exe Token: SeManageVolumePrivilege 4108 msiexec.exe Token: SeImpersonatePrivilege 4108 msiexec.exe Token: SeCreateGlobalPrivilege 4108 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2504 rfusclient.exe 2504 rfusclient.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2504 rfusclient.exe 2504 rfusclient.exe - Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 4196 rfusclient.exe 4196 rfusclient.exe 4196 rfusclient.exe 4196 rfusclient.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 1564 rutserv.exe 4752 rutserv.exe 4752 rutserv.exe 4752 rutserv.exe 4752 rutserv.exe 1748 rutserv.exe 1748 rutserv.exe 1748 rutserv.exe 1748 rutserv.exe 3296 rutserv.exe 3296 rutserv.exe 3296 rutserv.exe 3296 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 1540 rutserv.exe 2504 rfusclient.exe 4128 rfusclient.exe 2504 rfusclient.exe 4128 rfusclient.exe 4128 rfusclient.exe 4128 rfusclient.exe 2504 rfusclient.exe 2504 rfusclient.exe 4396 rfusclient.exe 4396 rfusclient.exe 4396 rfusclient.exe 4396 rfusclient.exe 4332 rutserv.exe 4332 rutserv.exe 4332 rutserv.exe 4332 rutserv.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4108 3176 Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe 83 PID 1800 wrote to memory of 1424 1800 msiexec.exe 86 PID 1800 wrote to memory of 4196 1800 msiexec.exe 87 PID 1800 wrote to memory of 1564 1800 msiexec.exe 90 PID 1800 wrote to memory of 4752 1800 msiexec.exe 95 PID 1800 wrote to memory of 3296 1800 msiexec.exe 99 PID 1540 wrote to memory of 4128 1540 rutserv.exe 101 PID 1540 wrote to memory of 2504 1540 rutserv.exe 102 PID 4128 wrote to memory of 4396 4128 rfusclient.exe 104 PID 1540 wrote to memory of 4332 1540 rutserv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\e66e696067061f30.msi" /qn /norestart ALLUSERS=12⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 666243546FA77D0AAA0C6FDD4FAE885F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1424
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\ProgramData\e66e696067061f30.msi"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4196
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4752
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3296
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4396
-
-
-
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2504
-
-
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4332
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e588e73.rbs
- Size 251KB
- SHA256 e9c217cd35138639b9fe8e9f8ba43b3d06a56f9fab45b1a47ddfaf27154fda5f
- MD5 9fcd7449a287ba85c72ffaba572d1985
- SHA1 91aa22b505764849dd03ee40fdff69fb2fb69b72
- SHA512 64704ad15756e1ca4637d1081304744de6aa8ddc75f1c21bb0c619f10339e136ad3095e5dcae00a84cc6089da35e1c190559a3dd8d44283b32dfb0ff2484c94f
- SSDEEP 6144:/HOfm1fZZBiVOy4h4CyzBFrnoxe5QMT+p+26zpLLXM3+0gH/sMnEp3hgqleWud0K:Y
- TLSH T1EA440818F646C8B9FA6F507576ACBF5190B730EB23C89A5430788458E3DAFED4D901E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf
- Size 23KB
- SHA256 6ff90bfe3b1805d9b4b71a1bc12268e77fd05480c8ffb2b9c568176b354a62e8
- MD5 e83d0dab290e912c34d59a6c2e3b34d8
- SHA1 2d57e3ae95c352a146836ba6239aa7661c08ccdc
- SHA512 83f6b3beedaad5ecc0688b3ce1b85e941077527df8b0ac34883193389613e88913ca606c45d5e599f3cf7d91cdfc99cb225a87a22f8d4344e2edad97b6c1c866
- SSDEEP 384:wIm2VyJPEDB4LPK7zEIsKb6V4/OhSCZH1Qszf7RYFEQukNaIX/ISspX6GE0dTOJy:5mFJPYB4LPg+fhzf2/f/Qtv
- TLSH T12EB2A7D2974907F307C502D72AE545C1A33E49F8693B59D93434B4482B638B8B3B69EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf
- Size 139KB
- SHA256 1fcb0c18d74b4157752a5776ca47bf31f893453b4bcb82ba67b402769d054c26
- MD5 b6d5dd2e4b2b3163f6bad087aa9f2ba4
- SHA1 a9ef4821812d21c6bd93c9bc262494331d8eb130
- SHA512 06b30fa94a1177c08dbcdf2251f2e48640bfe6403849d99af5522e0dd6e6978d9d30abc3d1023498b51cd9833ef9dc9845b73310cad2cd29650379f6f7c80b9b
- SSDEEP 3072:whBk6AJAB0A0JcfGiYH6kZNUFrgXVbwRdi7mbXUiZmoXYSFRdXvYkifGtGJFbxUm:MS6VFr8pwRdi7mbXUiZmoXYeRdXvYki3
- TLSH T179D3C6B84D4592D5CB6343426ABEF4CCAA39F01005B9B0F572AEC3F980BFD98DD5644A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
- Size 57KB
- SHA256 badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2
- MD5 382f1f40ace9eb75f55400d4bea1dbf6
- SHA1 94176ea4b9529c377bbdec1cb70458691b2efade
- SHA512 3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c
- SSDEEP 768:rDb11m1u0/h46F5BHk++oJAj7kqMJSxtr2xnh2END:rVl6hzk++oJY7ku/4hX
- TLSH T122437C13D702C177C51A4AF868B660D59A3B7E611C255EF713EB88F80DDD3836E0E25A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
- Size 9.6MB
- SHA256 f526c9173c5b1ccb38820656be96b800ff812a7aae18ab284e63834254528a15
- MD5 2dff5ec4d626ee10bc65cdece584350c
- SHA1 0f9443f38ac6bda938c48bb2bf142fb5b1b465c8
- SHA512 56aa6d2c1dd3031444e9b7fae529e80f59d68433c358ba905473adfcbafb8ae95e8218dbe2dd22d90b8d6e2ab44afeb4c53eb1d20676ef9a41ffe244a91f1d43
- SSDEEP 196608:HA566MuFnsyVd6UDastwHyAtZTgQLyvXOvRb4VFwvVnUVvJ22segUJxUAdmnc2EM:gzkTublWAuc2EeJUO9WLjdu
- TLSH T1EFA63951EA4B28F5EEA36771818BE33F5734AA00C636EFB7FB08D925E9336821505351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll
- Size 5.9MB
- SHA256 a4574de65c7d3ec0951447bf2a75f4ff392f4a28c0773cb9ea3afd61675f8ca8
- MD5 380830778aca0cdb53e9a7613388f246
- SHA1 7a817a8caf7f10049fb60974274988246017be03
- SHA512 c2caf144b4a9383e1edb36f2635f9a2d455908d78eb5f6753615603c8f688a32163d435f1a341b3b16aad206cb920dba462ae3734fafaedda2bca8def5b52253
- SSDEEP 98304:C3Hr7ZJmf0w7ymjb6666666666666666666666666666666x666666666666666q:C3HHvmf0w7yosJvo9n7PZ0
- TLSH T135565C42FACB19E1D8D32BB4519BE33B9738AE15C125DB7BFB48DA15F8633815819302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\licenses.txt
- Size 19KB
- SHA256 4ef24da2e7933364af0c7918207927283d0b7664c615b888cc80843d7a62faa4
- MD5 11b4de5dc2e474660c966c79bbcc0704
- SHA1 b921b50c8e4f68e2cdc76e00bbbfbdf479610b41
- SHA512 22e6a9254249647858e5e2c6f324cf0b7dcc9fcad9438453a0b966813f14102fb73bc9c40a037da9a1edea6c1f4ebca4ab71e69219730dd57affaa0ed9c83512
- SSDEEP 384:8vGt7E1Onas/O5yo0tkKXsl8rsxrsHbpeeYgr3rNajA8JjNwrFNrsmrsMdxeeYgP:81OnasW5ybkVyy9eYgb38JpwBNhPkeY6
- TLSH T1B092D86F734903731AE202A1764BA8C9F21E903C3B6B2A14305DD15C237BA2997B759D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
- Size 18.7MB
- SHA256 9949c3c80712de9a31ea95911adfe89807ffe9f73d238bd4d70b5ad79a0f1856
- MD5 75518945ad9df22f7b93e6089e9878c7
- SHA1 5ab1d456d1203a2861b481c6d01a97d33dd14033
- SHA512 ae5de79779b4f962d4a1b77257935f44c19148609b1344324b5062b03183974ddfde9128f4c3775af147f98affe842dcd17fc0d1fae19aaae2a47ba6bcc05bb7
- SSDEEP 196608:8F4/vUehstt44BaDg8HiOtZjsiy0MQU7I32QQhnbGpz:8a/vVhsJaDg0Dbsv0MeeGpz
- TLSH T13C178E03B244653ED0AB0B3A5937EB64593FBE612E12AC4767F8794C1F35A802D3B647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
- Size 22.1MB
- SHA256 7483a4dcafe94545cedce7c35671690f304c9ea1f943d692f7278898a295b114
- MD5 ba7af3d9589341cedbf396521bb71526
- SHA1 473eecab366eb37fc0a27a1f06ddd4f533ff2d73
- SHA512 371c46fae3ea64f4de60de2899e66dc8693b5dd9a0ec211e012e5912d1729f0905e87b9a764bb9f04d5dcb5a7696188737cbd4cddff84603988ffa6fe2da8ac9
- SSDEEP 393216:RgYWDiy5hZ8HCE6G2esNpnC9hCpMPzCQevOXUpF:LsXA6GTsC9tLaOX8F
- TLSH T1D8378E03B7849439D05B1E3A9D7BDA945E3F7E612A568C0B6BF43A8C4F355803D2B287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
- Size 384KB
- SHA256 851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718
- MD5 8e643fba05dbd17e52b0f57930a2b759
- SHA1 55e11d1cc910700da3a35ba55dc2985f3795c4be
- SHA512 266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6
- SSDEEP 6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwch:EI8tiDOzyH9H8Tu6h04fZMZoMPuvfR
- TLSH T157847C11A6828131D8FE05B8ACBCEE95222CEE0E9F744DDBD38C294959B21D15774FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
- Size 1.6MB
- SHA256 1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400
- MD5 e58922447d2d0a9c007ccdca2a37cd81
- SHA1 56dfa225585db1e31bea28a8225dfce18a4c0625
- SHA512 cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82
- SSDEEP 49152:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
- TLSH T16E756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
- Size 264KB
- SHA256 1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4
- MD5 696b0057893c38580911c0579a9909b0
- SHA1 59c22298a5c37ca26999acac9e16822247cdfc47
- SHA512 38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b
- SSDEEP 3072:XW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTg:XWSfr7sXSmPDbKPJ6/AsNk+Dy
- TLSH T1B1448E013685C075E9EF027198796B6A18FCBD724B64C6CBE7881D4E1E312C2BB3675B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
- Size 369KB
- SHA256 2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de
- MD5 170c0540946feeb20199d9a594e11879
- SHA1 ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd
- SHA512 33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa
- SSDEEP 6144:qaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtwl1:yoPH0GgEp0gVd1ValsQXsHy1
- TLSH T1BE848C01B9A2C57ED4EE017018AC7A4BD9793A6D07B8CCF317981AFE0D60EC15EB6257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
- Size 864KB
- SHA256 f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721
- MD5 7a8acedc516cc199f7b56ca09def1ab0
- SHA1 f0579f76bae11358f4efa0d4a2aa46a7c667865c
- SHA512 5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f
- SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNd:hYF+Eyx2lzujtEIYRc1cQmsGa7ONd
- TLSH T18915A213F9929D67D7E802310091F5355622BCBCC3E35AF73B8476FD39A6A805F6A620
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\e66e696067061f30.msi
- Size 28.7MB
- SHA256 618985288f335b8a116a1db59a055631817f3406a92e6a1bdefdc524d65e6db1
- MD5 46aae36e68f092771fd91ee2d7afd862
- SHA1 11b6979364622bd7f02019a5f8ddf6d7d488aa74
- SHA512 ab7fcf859292f14b3506401da74988335577402adcfb682d28636a124c3619e01d46a1b472920d386bc1611ba89b5138dc749933ccc50bba8227124bdb98facc
- SSDEEP 786432:MVGNvkTx+X0A6FEUPKevwV3S2DpV0SRq:UGpkF+X0yUywUSupVJQ
- TLSH T1EF6723C2F641447AFA5F0231A2FABF1C447AFCE957D4224A24E4B21961F3EE61D660C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI995D.tmp
- Size 165KB
- SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
- MD5 b5adf92090930e725510e2aafe97434f
- SHA1 eb9aff632e16fcb0459554979d3562dcf5652e21
- SHA512 1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509
- SSDEEP 3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
- TLSH T182F3281177E18030E5EF1A3A69749A264B7F7C72CB7489CBB384464E1D70AC1AE35B23
- MD5 SHA1 SHA512 SSDEEP TLSH