rurat | 28c4386ec07652a9aa692e89065ada8925096e739ac6478601dbab198fba9a42

Analysis

max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe
Size 29.7MB
Sample261104-rblhdadf72
SHA256 28c4386ec07652a9aa692e89065ada8925096e739ac6478601dbab198fba9a42
MD5 82c798157c3c18c010f5daf14ebd2448
SHA1 d493d61f75f370fb555c16c76300f0bc4c7b8a2c
SHA512 9a45082c539ff706855e6fe3f10d03124ecbdeda3851aca2b31ac77d6560b460fdfd2752b3e04106f3b4a1e8ce67684eae65d74add117dd8cbfd4d7b68f3d778
SSDEEP 393216:0qgaAdUcRIhGwIo9B4n8qVbHC3WxOLwZhNRbh5mL1mlJZVTae2DEdwcyKpxCxlrO:0TaAd1IA5os6WELuRdVlJZJB+t9IC/Ty
TLSH
T1A467331AF284BAEAC53A5578CFD41811F573B8CE47F16BDB13A40CA58EB3E506D36212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery rurat spyware trojan

Malware Config

Signatures

Family: RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Executes dropped EXE 10 IoCs

pid	Process
264	rfusclient.exe
2924	rutserv.exe
5936	rutserv.exe
2368	rutserv.exe
6056	rutserv.exe
5540	rutserv.exe
4728	rfusclient.exe
924	rfusclient.exe
4628	rfusclient.exe
2224	rutserv.exe

Loads dropped DLL 11 IoCs

pid	Process
2544	MsiExec.exe
264	rfusclient.exe
2924	rutserv.exe
5936	rutserv.exe
2368	rutserv.exe
6056	rutserv.exe
5540	rutserv.exe
924	rfusclient.exe
4728	rfusclient.exe
4628	rfusclient.exe
2224	rutserv.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_0836302494CC90535066A23E63C0A2F2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_0836302494CC90535066A23E63C0A2F2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_DF8B1CCAD690136970E760B4D18D549F	rutserv.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\licenses.txt	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59143a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B4F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59143e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC0E2A0F120CE4714.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC1D11771B99F2166.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59143a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCD6DEC926AA8D940.TMP	msiexec.exe
File created	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{914C90D4-58B9-5A32-8F83-85D03BA2991B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3287F7228613F569.TMP	msiexec.exe
File created	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000c00000001c5dc-81.dat	embeds_openssl

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rutserv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rfusclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rutserv.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\PackageCode = "A5C3A0D207F69264DA5BE2DC652AF39C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\ProductIcon = "C:\\Windows\\Installer\\{914C90D4-58B9-5A32-8F83-85D03BA2991B}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\4D09C4199B8523A5F838580DB32A99B1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Net\1 = "C:\\ProgramData\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4D09C4199B8523A5F838580DB32A99B1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4D09C4199B8523A5F838580DB32A99B1\RMS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Version = "118030336"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\PackageName = "3d09f84553221c2e.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4D09C4199B8523A5F838580DB32A99B1\InstanceType = "0"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	rutserv.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
264	rfusclient.exe
264	rfusclient.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
5936	rutserv.exe
5936	rutserv.exe
2368	rutserv.exe
2368	rutserv.exe
6056	rutserv.exe
6056	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
924	rfusclient.exe
924	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4628	rfusclient.exe
4628	rfusclient.exe
2224	rutserv.exe
2224	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3804	msiexec.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeCreateTokenPrivilege	3804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3804	msiexec.exe
Token: SeLockMemoryPrivilege	3804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3804	msiexec.exe
Token: SeMachineAccountPrivilege	3804	msiexec.exe
Token: SeTcbPrivilege	3804	msiexec.exe
Token: SeSecurityPrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeLoadDriverPrivilege	3804	msiexec.exe
Token: SeSystemProfilePrivilege	3804	msiexec.exe
Token: SeSystemtimePrivilege	3804	msiexec.exe
Token: SeProfSingleProcessPrivilege	3804	msiexec.exe
Token: SeIncBasePriorityPrivilege	3804	msiexec.exe
Token: SeCreatePagefilePrivilege	3804	msiexec.exe
Token: SeCreatePermanentPrivilege	3804	msiexec.exe
Token: SeBackupPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeShutdownPrivilege	3804	msiexec.exe
Token: SeDebugPrivilege	3804	msiexec.exe
Token: SeAuditPrivilege	3804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3804	msiexec.exe
Token: SeChangeNotifyPrivilege	3804	msiexec.exe
Token: SeRemoteShutdownPrivilege	3804	msiexec.exe
Token: SeUndockPrivilege	3804	msiexec.exe
Token: SeSyncAgentPrivilege	3804	msiexec.exe
Token: SeEnableDelegationPrivilege	3804	msiexec.exe
Token: SeManageVolumePrivilege	3804	msiexec.exe
Token: SeImpersonatePrivilege	3804	msiexec.exe
Token: SeCreateGlobalPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
924	rfusclient.exe
924	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
924	rfusclient.exe
924	rfusclient.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
3804	msiexec.exe
4624	msiexec.exe
2544	MsiExec.exe
264	rfusclient.exe
264	rfusclient.exe
264	rfusclient.exe
264	rfusclient.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
2924	rutserv.exe
5936	rutserv.exe
5936	rutserv.exe
5936	rutserv.exe
5936	rutserv.exe
2368	rutserv.exe
2368	rutserv.exe
2368	rutserv.exe
2368	rutserv.exe
6056	rutserv.exe
6056	rutserv.exe
6056	rutserv.exe
6056	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
5540	rutserv.exe
924	rfusclient.exe
4728	rfusclient.exe
924	rfusclient.exe
924	rfusclient.exe
924	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4728	rfusclient.exe
4628	rfusclient.exe
4628	rfusclient.exe
4628	rfusclient.exe
4628	rfusclient.exe
2224	rutserv.exe
2224	rutserv.exe
2224	rutserv.exe
2224	rutserv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3804	5032	Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe	89
PID 4624 wrote to memory of 2544	4624	msiexec.exe	91
PID 4624 wrote to memory of 264	4624	msiexec.exe	92
PID 4624 wrote to memory of 2924	4624	msiexec.exe	93
PID 4624 wrote to memory of 5936	4624	msiexec.exe	95
PID 4624 wrote to memory of 6056	4624	msiexec.exe	97
PID 5540 wrote to memory of 4728	5540	rutserv.exe	99
PID 5540 wrote to memory of 924	5540	rutserv.exe	100
PID 4728 wrote to memory of 4628	4728	rfusclient.exe	102
PID 5540 wrote to memory of 2224	5540	rutserv.exe	103

C:\Users\Admin\AppData\Local\Temp\Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Податкове повідомлення-рішення 04.11.2026.473245.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\3d09f84553221c2e.msi" /qn /norestart ALLUSERS=1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 54AC23101FEBD0DF7A9B96A3467141A3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2544
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\ProgramData\3d09f84553221c2e.msi"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:264
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2924
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5936
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6056

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2368

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4628
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:924
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59143d.rbs

Path C:\Config.Msi\e59143d.rbs
Size 251KB
SHA256 7b39b98e9aa6a08374323c97a9e7f37ee03331c4dc69c57349ee30b3aa097519
MD5 b9794cb63e7eade7859d31671837e1fb
SHA1 2b32d06128df69e538cbbd690bf6e4bac5031ddb
SHA512 7a4886fceb6d5fbe7fbe47a60a94f5adced73bb86971a9bb9e559717064d8a69ce74f01090defaeeb6ac856e5329439f51c38c599247b3c37895a11ae8df9a6e
SSDEEP 6144:THOfm1fZZBiVOy4h4CyzBFrnoxe5QMT+p+26zpLLXM3+0gH/sMnEp3hgqleWud0s:O
TLSH
T14F440818F646C8B9FA6F507576ACBF5190B730EB23C89A5430788458E3DAFED4D901E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EULA.rtf

Path C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf
Size 23KB
SHA256 6ff90bfe3b1805d9b4b71a1bc12268e77fd05480c8ffb2b9c568176b354a62e8
MD5 e83d0dab290e912c34d59a6c2e3b34d8
SHA1 2d57e3ae95c352a146836ba6239aa7661c08ccdc
SHA512 83f6b3beedaad5ecc0688b3ce1b85e941077527df8b0ac34883193389613e88913ca606c45d5e599f3cf7d91cdfc99cb225a87a22f8d4344e2edad97b6c1c866
SSDEEP 384:wIm2VyJPEDB4LPK7zEIsKb6V4/OhSCZH1Qszf7RYFEQukNaIX/ISspX6GE0dTOJy:5mFJPYB4LPg+fhzf2/f/Qtv
TLSH
T12EB2A7D2974907F307C502D72AE545C1A33E49F8693B59D93434B4482B638B8B3B69EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Privacy_policy.rtf

Path C:\Program Files (x86)\Remote Utilities - Host\Privacy_policy.rtf
Size 139KB
SHA256 1fcb0c18d74b4157752a5776ca47bf31f893453b4bcb82ba67b402769d054c26
MD5 b6d5dd2e4b2b3163f6bad087aa9f2ba4
SHA1 a9ef4821812d21c6bd93c9bc262494331d8eb130
SHA512 06b30fa94a1177c08dbcdf2251f2e48640bfe6403849d99af5522e0dd6e6978d9d30abc3d1023498b51cd9833ef9dc9845b73310cad2cd29650379f6f7c80b9b
SSDEEP 3072:whBk6AJAB0A0JcfGiYH6kZNUFrgXVbwRdi7mbXUiZmoXYSFRdXvYkifGtGJFbxUm:MS6VFr8pwRdi7mbXUiZmoXYeRdXvYki3
TLSH
T179D3C6B84D4592D5CB6343426ABEF4CCAA39F01005B9B0F572AEC3F980BFD98DD5644A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventmsg.dll

Path C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
Size 57KB
SHA256 badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2
MD5 382f1f40ace9eb75f55400d4bea1dbf6
SHA1 94176ea4b9529c377bbdec1cb70458691b2efade
SHA512 3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c
SSDEEP 768:rDb11m1u0/h46F5BHk++oJAj7kqMJSxtr2xnh2END:rVl6hzk++oJY7ku/4hX
TLSH
T122437C13D702C177C51A4AF868B660D59A3B7E611C255EF713EB88F80DDD3836E0E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libasset32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libasset32.dll
Size 9.6MB
SHA256 f526c9173c5b1ccb38820656be96b800ff812a7aae18ab284e63834254528a15
MD5 2dff5ec4d626ee10bc65cdece584350c
SHA1 0f9443f38ac6bda938c48bb2bf142fb5b1b465c8
SHA512 56aa6d2c1dd3031444e9b7fae529e80f59d68433c358ba905473adfcbafb8ae95e8218dbe2dd22d90b8d6e2ab44afeb4c53eb1d20676ef9a41ffe244a91f1d43
SSDEEP 196608:HA566MuFnsyVd6UDastwHyAtZTgQLyvXOvRb4VFwvVnUVvJ22segUJxUAdmnc2EM:gzkTublWAuc2EeJUO9WLjdu
TLSH
T1EFA63951EA4B28F5EEA36771818BE33F5734AA00C636EFB7FB08D925E9336821505351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcodec32.dll

Path C:\Program Files (x86)\Remote Utilities - Host\libcodec32.dll
Size 5.9MB
SHA256 a4574de65c7d3ec0951447bf2a75f4ff392f4a28c0773cb9ea3afd61675f8ca8
MD5 380830778aca0cdb53e9a7613388f246
SHA1 7a817a8caf7f10049fb60974274988246017be03
SHA512 c2caf144b4a9383e1edb36f2635f9a2d455908d78eb5f6753615603c8f688a32163d435f1a341b3b16aad206cb920dba462ae3734fafaedda2bca8def5b52253
SSDEEP 98304:C3Hr7ZJmf0w7ymjb6666666666666666666666666666666x666666666666666q:C3HHvmf0w7yosJvo9n7PZ0
TLSH
T135565C42FACB19E1D8D32BB4519BE33B9738AE15C125DB7BFB48DA15F8633815819302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licenses.txt

Path C:\Program Files (x86)\Remote Utilities - Host\licenses.txt
Size 19KB
SHA256 4ef24da2e7933364af0c7918207927283d0b7664c615b888cc80843d7a62faa4
MD5 11b4de5dc2e474660c966c79bbcc0704
SHA1 b921b50c8e4f68e2cdc76e00bbbfbdf479610b41
SHA512 22e6a9254249647858e5e2c6f324cf0b7dcc9fcad9438453a0b966813f14102fb73bc9c40a037da9a1edea6c1f4ebca4ab71e69219730dd57affaa0ed9c83512
SSDEEP 384:8vGt7E1Onas/O5yo0tkKXsl8rsxrsHbpeeYgr3rNajA8JjNwrFNrsmrsMdxeeYgP:81OnasW5ybkVyy9eYgb38JpwBNhPkeY6
TLSH
T1B092D86F734903731AE202A1764BA8C9F21E903C3B6B2A14305DD15C237BA2997B759D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rfusclient.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Size 18.7MB
SHA256 9949c3c80712de9a31ea95911adfe89807ffe9f73d238bd4d70b5ad79a0f1856
MD5 75518945ad9df22f7b93e6089e9878c7
SHA1 5ab1d456d1203a2861b481c6d01a97d33dd14033
SHA512 ae5de79779b4f962d4a1b77257935f44c19148609b1344324b5062b03183974ddfde9128f4c3775af147f98affe842dcd17fc0d1fae19aaae2a47ba6bcc05bb7
SSDEEP 196608:8F4/vUehstt44BaDg8HiOtZjsiy0MQU7I32QQhnbGpz:8a/vVhsJaDg0Dbsv0MeeGpz
TLSH
T13C178E03B244653ED0AB0B3A5937EB64593FBE612E12AC4767F8794C1F35A802D3B647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rutserv.exe

Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Size 22.1MB
SHA256 7483a4dcafe94545cedce7c35671690f304c9ea1f943d692f7278898a295b114
MD5 ba7af3d9589341cedbf396521bb71526
SHA1 473eecab366eb37fc0a27a1f06ddd4f533ff2d73
SHA512 371c46fae3ea64f4de60de2899e66dc8693b5dd9a0ec211e012e5912d1729f0905e87b9a764bb9f04d5dcb5a7696188737cbd4cddff84603988ffa6fe2da8ac9
SSDEEP 393216:RgYWDiy5hZ8HCE6G2esNpnC9hCpMPzCQevOXUpF:LsXA6GTsC9tLaOX8F
TLSH
T1D8378E03B7849439D05B1E3A9D7BDA945E3F7E612A568C0B6BF43A8C4F355803D2B287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8decoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
Size 384KB
SHA256 851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718
MD5 8e643fba05dbd17e52b0f57930a2b759
SHA1 55e11d1cc910700da3a35ba55dc2985f3795c4be
SHA512 266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6
SSDEEP 6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwch:EI8tiDOzyH9H8Tu6h04fZMZoMPuvfR
TLSH
T157847C11A6828131D8FE05B8ACBCEE95222CEE0E9F744DDBD38C294959B21D15774FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp8encoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
Size 1.6MB
SHA256 1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400
MD5 e58922447d2d0a9c007ccdca2a37cd81
SHA1 56dfa225585db1e31bea28a8225dfce18a4c0625
SHA512 cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82
SSDEEP 49152:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww7:5SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
TLSH
T16E756D50E183A061C87D18F45EBEEECA792C6A3C472058EB62D45B48B9F53C09B75EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmmux.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
Size 264KB
SHA256 1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4
MD5 696b0057893c38580911c0579a9909b0
SHA1 59c22298a5c37ca26999acac9e16822247cdfc47
SHA512 38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b
SSDEEP 3072:XW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTg:XWSfr7sXSmPDbKPJ6/AsNk+Dy
TLSH
T1B1448E013685C075E9EF027198796B6A18FCBD724B64C6CBE7881D4E1E312C2BB3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisdecoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
Size 369KB
SHA256 2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de
MD5 170c0540946feeb20199d9a594e11879
SHA1 ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd
SHA512 33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa
SSDEEP 6144:qaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rtwl1:yoPH0GgEp0gVd1ValsQXsHy1
TLSH
T1BE848C01B9A2C57ED4EE017018AC7A4BD9793A6D07B8CCF317981AFE0D60EC15EB6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webmvorbisencoder.dll

Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
Size 864KB
SHA256 f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721
MD5 7a8acedc516cc199f7b56ca09def1ab0
SHA1 f0579f76bae11358f4efa0d4a2aa46a7c667865c
SHA512 5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f
SSDEEP 12288:KTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNd:hYF+Eyx2lzujtEIYRc1cQmsGa7ONd
TLSH
T18915A213F9929D67D7E802310091F5355622BCBCC3E35AF73B8476FD39A6A805F6A620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d09f84553221c2e.msi

Path C:\ProgramData\3d09f84553221c2e.msi
Size 28.7MB
SHA256 618985288f335b8a116a1db59a055631817f3406a92e6a1bdefdc524d65e6db1
MD5 46aae36e68f092771fd91ee2d7afd862
SHA1 11b6979364622bd7f02019a5f8ddf6d7d488aa74
SHA512 ab7fcf859292f14b3506401da74988335577402adcfb682d28636a124c3619e01d46a1b472920d386bc1611ba89b5138dc749933ccc50bba8227124bdb98facc
SSDEEP 786432:MVGNvkTx+X0A6FEUPKevwV3S2DpV0SRq:UGpkF+X0yUywUSupVJQ
TLSH
T1EF6723C2F641447AFA5F0231A2FABF1C447AFCE957D4224A24E4B21961F3EE61D660C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI18CE.tmp

Path C:\Windows\Installer\MSI18CE.tmp
Size 165KB
SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
MD5 b5adf92090930e725510e2aafe97434f
SHA1 eb9aff632e16fcb0459554979d3562dcf5652e21
SHA512 1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509
SSDEEP 3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
TLSH
T182F3281177E18030E5EF1A3A69749A264B7F7C72CB7489CBB384464E1D70AC1AE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-83-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/264-84-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/924-230-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-223-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-216-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-237-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-209-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-202-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-195-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-188-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-156-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-177-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-170-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-163-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/924-157-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/2224-184-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/2224-183-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/2368-122-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/2368-121-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/2924-105-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/2924-106-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/4628-152-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/4628-153-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/4728-154-0x0000000000170000-0x00000000014D7000-memory.dmp

Download

memory/4728-155-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/5540-190-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-211-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-239-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-179-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-158-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-197-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-146-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-204-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-172-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-148-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/5540-232-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-218-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-165-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5540-225-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5936-110-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download

memory/5936-112-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/6056-141-0x000000006D280000-0x000000006D9CF000-memory.dmp

Download

memory/6056-137-0x0000000000590000-0x0000000001C6E000-memory.dmp

Download