Edit tour

Windows Analysis Report
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Overview

General Information

Sample name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe renamed because original name is a hash value
Original sample name:	3_.pdf.exe
Analysis ID:	1385428
MD5:	075d6c122274cb9226521d3cd298f2f2
SHA1:	6f54d70f39fa28596ef90bfcb0c14278b016db1b
SHA256:	92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573
Tags:	exeRemoteUtilitiesrurat
Infos:

Detection

RMSRemoteAdmin, Remote Utilities

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remote Utilities RAT

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Initial sample is a PE file and has a suspicious name

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores large binary data to the registry

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe (PID: 7316 cmdline: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe MD5: 075D6C122274CB9226521D3CD298F2F2)

msiexec.exe (PID: 7416 cmdline: "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7448 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7528 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 7600 cmdline: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi MD5: 6AAE165F3B1575DB887A0370CFC80083)

rutserv.exe (PID: 7640 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7676 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7876 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 8008 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall MD5: 652C2A693B333504A3879460D0AF7224)

rfusclient.exe (PID: 8048 cmdline: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe MD5: 6AAE165F3B1575DB887A0370CFC80083)

rfusclient.exe (PID: 5016 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray MD5: 6AAE165F3B1575DB887A0370CFC80083)

rfusclient.exe (PID: 8068 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray MD5: 6AAE165F3B1575DB887A0370CFC80083)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39d3a4:$s1: rman_message 0x405be0:$s3: rms_host_ 0x40657c:$s3: rms_host_ 0x7a410c:$s4: rman_av_capture_settings 0x3a76cc:$s7: _rms_log.txt 0x45d27c:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a02f0:$s1: rman_message 0x431f3c:$s3: rms_host_ 0x4328e0:$s3: rms_host_ 0x7d1f30:$s4: rman_av_capture_settings 0x83a260:$s5: rman_registry_key 0x83a2ac:$s5: rman_registry_key 0x4e5a1c:$s6: rms_system_information 0x2e6274:$s7: _rms_log.txt 0x4a5efc:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 7600	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7640	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7876	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.rfusclient.exe.650000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
4.0.rfusclient.exe.650000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39d3a4:$s1: rman_message 0x405be0:$s3: rms_host_ 0x40657c:$s3: rms_host_ 0x7a410c:$s4: rman_av_capture_settings 0x3a76cc:$s7: _rms_log.txt 0x45d27c:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, CommandLine: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, NewProcessName: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, OriginalFileName: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, ProcessId: 7316, ProcessName: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 101.99.94.54, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Initiated: true, ProcessId: 7876, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Virustotal: Detection: 28%

Perma Link

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002690 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017100 DES_ecb_encrypt,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002120 CRYPTO_set_mem_ex_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103A120 BN_BLINDING_create_param,CRYPTO_malloc,ERR_put_error,_memset,BN_dup,CRYPTO_THREADID_current,BN_new,BN_new,BN_free,BN_dup,BN_rand_range,BN_mod_inverse,ERR_peek_last_error,ERR_clear_error,BN_rand_range,ERR_put_error,BN_mod_exp,BN_BLINDING_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104C120 DSA_SIG_new,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108C120 ASN1_PCTX_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046130 RSA_padding_add_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,ERR_put_error,EVP_Digest,_memset,RAND_bytes,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E130 a2i_ASN1_ENUMERATED,BIO_gets,CRYPTO_malloc,CRYPTO_realloc,BIO_gets,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019150 DES_ofb_encrypt,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11047150 RSA_padding_add_PKCS1_PSS_mgf1,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,RAND_bytes,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,PKCS1_MGF1,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104C150 DSA_SIG_free,BN_free,BN_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E150 ERR_load_ERR_strings,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068160 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2160 ENGINE_add,ERR_put_error,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F170 idea_cbc_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002180 CRYPTO_set_locked_mem_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E180 DSO_new_method,DSO_METHOD_openssl,CRYPTO_malloc,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_free,sk_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072180 EVP_EncryptUpdate,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D180 EVP_PKEY_encrypt_init,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053190 EC_POINT_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110311A0 CRYPTO_gcm128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F1A0 ERR_peek_last_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110811A0 ASN1_item_i2d_bio,ASN1_item_i2d,ERR_put_error,BIO_write,BIO_write,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110171B0 DES_cbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105B1B0 EC_KEY_get_key_method_data,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110021C0 CRYPTO_set_locked_mem_ex_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110511C0 BN_dup,BN_free,BN_dup,BN_free,CRYPTO_free,BUF_memdup,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110531C0 EC_POINT_clear_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110031D0 CRYPTO_dbg_realloc,CRYPTO_dbg_malloc,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110721D0 EVP_EncryptFinal_ex,ERR_put_error,OpenSSLDie,ERR_put_error,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107F1D0 ASN1_UTCTIME_adj,ASN1_STRING_type_new,OPENSSL_gmtime,OPENSSL_gmtime_adj,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,BIO_snprintf,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110801D0 BN_to_ASN1_INTEGER,ASN1_STRING_type_new,BN_num_bits,CRYPTO_realloc,ERR_put_error,ASN1_STRING_free,BN_bn2bin,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F1D0 BIO_new_NDEF,CRYPTO_malloc,BIO_f_asn1,BIO_new,BIO_push,BIO_asn1_set_prefix,BIO_asn1_set_suffix,BIO_ctrl,BIO_free,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110041E0 CRYPTO_lock,sk_num,sk_num,CRYPTO_get_ex_data,CRYPTO_set_ex_data,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_set_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110501F0 DH_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D1F0 EVP_PKEY_encrypt,ERR_put_error,EVP_PKEY_size,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020000 BF_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053000 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082000 ASN1_item_digest,ASN1_item_i2d,EVP_Digest,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11086030 X509_CRL_METHOD_new,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068040 BIO_get_host_ip,ERR_put_error,BIO_sock_init,CRYPTO_lock,gethostbyname,ERR_put_error,ERR_put_error,CRYPTO_lock,ERR_add_error_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11070040 OBJ_add_object,lh_new,OBJ_dup,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ASN1_OBJECT_free,lh_insert,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11083050 i2d_ASN1_TYPE,CRYPTO_malloc,i2d_ASN1_TYPE,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E060 RC2_cfb64_encrypt,RC2_encrypt,RC2_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053060 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004070 CRYPTO_get_ex_data,sk_num,sk_value,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030070 CRYPTO_nistcts128_decrypt_block,CRYPTO_cbc128_decrypt,CRYPTO_cbc128_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023080 CAST_ofb64_encrypt,CAST_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11050080 DH_new_method,CRYPTO_malloc,ERR_put_error,DH_OpenSSL,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_DH,X509_PURPOSE_get0_name,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080080 ASN1_INTEGER_set,CRYPTO_free,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082080 ASN1_verify,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_VerifyFinal,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110020A0 CRYPTO_set_mem_functions,OPENSSL_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110040A0 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110530A0 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110310B0 CRYPTO_gcm128_aad,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D0B0 EVP_PKEY_asn1_add_alias,CRYPTO_malloc,_memset,EVP_PKEY_asn1_add0,EVP_PKEY_asn1_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F0C0 BN_MONT_CTX_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110810C0 ASN1_i2d_bio,CRYPTO_malloc,ERR_put_error,BIO_write,BIO_write,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110840D0 X509_PUBKEY_set0_param,X509_ALGOR_set0,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110030E0 CRYPTO_dbg_free,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,CRYPTO_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110530E0 EC_POINT_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002300 CRYPTO_get_locked_mem_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022300 CAST_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067300 BIO_vprintf,CRYPTO_push_info_,CRYPTO_free,BIO_write,CRYPTO_free,BIO_write,CRYPTO_pop_info,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11086300 X509_INFO_free,CRYPTO_add_lock,X509_free,X509_CRL_free,X509_PKEY_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023310 AES_cfb1_encrypt,AES_encrypt,CRYPTO_cfb128_1_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11050310 DH_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105F310 ECPKParameters_print,BN_CTX_new,EC_GROUP_get_asn1_flag,BIO_indent,ENGINE_get_pkey_asn1_meths,OBJ_nid2sn,BIO_printf,BIO_printf,EC_curve_nid2nist,BIO_indent,BIO_printf,pqueue_peek,X509_TRUST_get_flags,BN_new,BN_new,BN_new,BN_new,BN_new,EC_GROUP_get_curve_GF2m,EC_GROUP_get_curve_GFp,X509_TRUST_get_flags,EC_GROUP_get_order,EC_GROUP_get_cofactor,ENGINE_get_init_function,EC_POINT_point2bn,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,ENGINE_get_finish_function,EVP_MD_block_size,CRYPTO_malloc,BIO_indent,OBJ_nid2sn,BIO_printf,EC_GROUP_get_basis_type,BIO_indent,OBJ_nid2sn,BIO_printf,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ERR_put_error,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_CTX_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11039320 BN_set_word,CRYPTO_malloc,ERR_put_error,__time64,RAND_add,RAND_bytes,RAND_pseudo_bytes,BN_bin2bn,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A320 RSA_public_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11057320 ERR_put_error,EC_POINT_set_to_infinity,BN_CTX_new,X509_TRUST_get_flags,ERR_put_error,EC_POINT_cmp,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free,EC_POINT_new,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_add,EC_POINTs_make_affine,EC_POINT_dbl,EC_POINT_invert,EC_POINT_copy,EC_POINT_add,EC_POINT_set_to_infinity,EC_POINT_invert,ERR_put_error,BN_CTX_free,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A330 RSA_private_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081330 ASN1_ENUMERATED_set,CRYPTO_free,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11085330 X509_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002340 CRYPTO_get_locked_mem_ex_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A340 RSA_private_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046340 RSA_padding_check_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,EVP_Digest,CRYPTO_memcmp,ERR_put_error,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11093340 ASN1_STRING_TABLE_add,sk_new,ERR_put_error,ASN1_STRING_TABLE_get,CRYPTO_malloc,ERR_put_error,sk_push,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023350 AES_cfb8_encrypt,AES_encrypt,CRYPTO_cfb128_8_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037350 CRYPTO_malloc,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E350 DSO_up_ref,ERR_put_error,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045350 RSA_verify_ASN1_OCTET_STRING,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,RSA_public_decrypt,d2i_ASN1_OCTET_STRING,ERR_put_error,ASN1_STRING_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A350 RSA_public_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2350 ENGINE_finish,ERR_put_error,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E360 ERR_clear_error,ERR_get_state,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E360 a2d_ASN1_OBJECT,ERR_put_error,BN_new,BN_set_word,BN_mul_word,BN_add_word,BN_add_word,BN_num_bits,CRYPTO_free,CRYPTO_malloc,BN_div_word,CRYPTO_free,BN_free,ERR_put_error,CRYPTO_free,BN_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D360 EVP_PKEY_decrypt,ERR_put_error,EVP_PKEY_size,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002370 CRYPTO_get_mem_debug_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004380 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,CRYPTO_lock,sk_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_free,sk_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C380 EVP_PKEY_meth_new,CRYPTO_malloc,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023390 AES_ofb128_encrypt,AES_encrypt,CRYPTO_ofb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F3A0 ERR_load_crypto_strings,ERR_load_BN_strings,ERR_load_RSA_strings,ERR_load_DH_strings,ERR_load_EVP_strings,ERR_load_BUF_strings,ERR_load_OBJ_strings,ERR_load_PEM_strings,ERR_load_DSA_strings,ERR_load_X509_strings,ERR_load_ASN1_strings,ERR_load_CONF_strings,ERR_load_CRYPTO_strings,ERR_load_COMP_strings,ERR_load_EC_strings,ERR_load_ECDSA_strings,ERR_load_ECDH_strings,ERR_load_BIO_strings,ERR_load_PKCS7_strings,ERR_load_X509V3_strings,ERR_load_PKCS12_strings,ERR_load_RAND_strings,ERR_load_DSO_strings,ERR_load_TS_strings,ERR_load_ENGINE_strings,ERR_load_OCSP_strings,ERR_load_UI_strings,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E3A0 X509_PKEY_free,d2i_NETSCAPE_SPKAC,d2i_NETSCAPE_SPKAC,CRYPTO_add_lock,X509_ALGOR_free,ASN1_STRING_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110633B0 BIO_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F3B0 sk_num,BIO_write,sk_value,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,BIO_puts,CRYPTO_free,BIO_puts,BIO_puts,sk_num,BIO_puts,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110233C0 AES_ctr128_encrypt,AES_encrypt,CRYPTO_ctr128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F3C0 SEED_ecb_encrypt,SEED_encrypt,SEED_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A3C0 sk_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110023D0 CRYPTO_malloc_locked,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110303E0 CRYPTO_nistcts128_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110373E0 BN_clear_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110413E0 BN_GF2m_mod_solve_quad,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_solve_quad_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B23EE sk_value,CMS_RecipientEncryptedKey_cert_cmp,sk_num,CMS_RecipientInfo_kari_set0_pkey,CMS_RecipientInfo_kari_decrypt,CMS_RecipientInfo_kari_set0_pkey,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E3E0 ERR_get_state,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F3F0 SEED_cbc_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002200 CRYPTO_set_mem_debug_functions,OPENSSL_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018200 DES_cfb_encrypt,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025200 AES_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105B200 EC_KEY_insert_key_method_data,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110CA200 UI_new,CRYPTO_malloc,ERR_put_error,UI_OpenSSL,CRYPTO_new_ex_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9200 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032210 CRYPTO_ccm128_encrypt_ccm64,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11035210 BN_mod_exp_mont_consttime,BN_set_word,BN_set_word,BN_CTX_start,BN_MONT_CTX_new,BN_MONT_CTX_set,CRYPTO_malloc,_memset,BN_value_one,BN_ucmp,BN_div,BN_is_bit_set,BN_is_bit_set,BN_from_montgomery,BN_MONT_CTX_free,OPENSSL_cleanse,CRYPTO_free,BN_CTX_end,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022230 CAST_ecb_encrypt,CAST_encrypt,CAST_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082230 ASN1_item_verify,ERR_put_error,ERR_put_error,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_find_sigid_algs,ERR_put_error,ERR_put_error,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_PKEY_type,ERR_put_error,EVP_DigestVerifyInit,ASN1_item_i2d,ERR_put_error,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_DigestVerifyFinal,ERR_put_error,EVP_MD_CTX_cleanup,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2240 CRYPTO_lock,CRYPTO_lock,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002250 CRYPTO_get_mem_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E250 RC2_ofb64_encrypt,RC2_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027250 private_AES_set_encrypt_key,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045250 RSA_sign_ASN1_OCTET_STRING,i2d_ASN1_OCTET_STRING,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_ASN1_OCTET_STRING,RSA_private_encrypt,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E250 DSO_free,ERR_put_error,CRYPTO_add_lock,ERR_put_error,ERR_put_error,sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9250 UI_free,sk_pop_free,CRYPTO_free_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027260 private_AES_set_decrypt_key,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D260 a2i_ASN1_INTEGER,BIO_gets,CRYPTO_malloc,CRYPTO_realloc_clean,BIO_gets,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053270 EC_POINT_dup,EC_POINT_new,EC_POINT_copy,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E270 ERR_put_error,ERR_get_state,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108C280 i2s_ASN1_INTEGER,BIO_puts,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9280 ERR_put_error,ERR_put_error,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E290 i2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ERR_put_error,ASN1_put_object,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110232A0 AES_ecb_encrypt,AES_encrypt,AES_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110712A0 OBJ_add_sigid,sk_new,sk_new,CRYPTO_malloc,sk_push,CRYPTO_free,sk_push,sk_sort,sk_sort,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110022B0 CRYPTO_get_mem_ex_functions,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110862B0 X509_INFO_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110592C0 BN_new,BN_new,pqueue_peek,X509_TRUST_get_flags,EC_GROUP_get_curve_GFp,ERR_put_error,EC_GROUP_get_curve_GF2m,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_bn2bin,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,ASN1_STRING_set,ASN1_STRING_set,ASN1_BIT_STRING_new,CRYPTO_malloc,BN_bn2bin,ASN1_OCTET_STRING_set,ASN1_BIT_STRING_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110232D0 AES_cfb128_encrypt,AES_encrypt,CRYPTO_cfb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110302D0 CRYPTO_cts128_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110372D0 bn_dup_expand,BN_new,CRYPTO_free,BN_new,BN_copy,BN_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C22D0 ENGINE_init,ERR_put_error,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110032E0 __localtime64,BIO_snprintf,BIO_snprintf,X509_TRUST_get_flags,BIO_snprintf,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cpy,_memset,X509_TRUST_get_flags,BIO_snprintf,BUF_strlcpy,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110502E0 DH_up_ref,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110722E0 EVP_DecryptUpdate,ERR_put_error,OpenSSLDie,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D2F0 EVP_PKEY_decrypt_init,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094500 _strrchr,OBJ_create,CRYPTO_malloc,OBJ_nid2obj,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004510 ERR_load_CRYPTO_strings,ERR_func_error_string,ERR_load_strings,ERR_load_strings,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002510 CRYPTO_strdup,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030510 CRYPTO_cfb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105A520 i2d_ECPrivateKey,ASN1_item_new,ERR_put_error,BN_num_bits,EC_GROUP_get_degree,ERR_put_error,CRYPTO_malloc,BN_bn2bin,_memset,ASN1_STRING_set,ERR_put_error,CRYPTO_free,ASN1_item_free,ASN1_STRING_type_new,EC_POINT_point2oct,CRYPTO_realloc,EC_POINT_point2oct,ASN1_STRING_set,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061520 CRYPTO_malloc,ERR_put_error,ECDSA_OpenSSL,ENGINE_get_default_ECDSA,EVP_PKEY_CTX_get_app_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092530 ASN1_STRING_set,CRYPTO_malloc,CRYPTO_realloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003540 CRYPTO_mem_leaks,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,lh_doall_arg,BIO_printf,CRYPTO_lock,lh_free,lh_num_items,lh_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11091540 CONF_parse_list,i2d_ASN1_TYPE,ASN1_TYPE_free,ASN1_get_object,ASN1_object_size,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,ASN1_put_object,d2i_ASN1_TYPE,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7540 X509_STORE_CTX_get0_policy_tree,EVP_PKEY_derive,EVP_CipherInit_ex,EVP_CipherUpdate,CRYPTO_malloc,EVP_CipherUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_CIPHER_CTX_cleanup,EVP_PKEY_CTX_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F550 BN_MONT_CTX_new,CRYPTO_malloc,BN_init,BN_init,BN_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002560 CRYPTO_realloc,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001580 CRYPTO_num_locks,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001590 CRYPTO_destroy_dynlockid,CRYPTO_lock,sk_num,sk_value,sk_set,CRYPTO_lock,CRYPTO_free,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037590 BN_CTX_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107B590 EVP_PBE_alg_add_type,sk_new,CRYPTO_malloc,ERR_put_error,sk_push,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E5A0 DSO_set_filename,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D5A0 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,_strerror,_strncpy,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F5B0 BN_MONT_CTX_set_locked,CRYPTO_lock,CRYPTO_lock,BN_MONT_CTX_new,BN_MONT_CTX_set,BN_MONT_CTX_free,CRYPTO_lock,BN_MONT_CTX_free,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110775B0 EVP_OpenInit,EVP_CIPHER_CTX_init,EVP_DecryptInit_ex,ERR_put_error,CRYPTO_free,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_PKEY_decrypt_old,EVP_CIPHER_CTX_set_key_length,EVP_DecryptInit_ex,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110325C0 CRYPTO_ccm128_tag,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110725C0 EVP_CIPHER_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,ENGINE_finish,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D5C0 a2i_ASN1_STRING,BIO_gets,CRYPTO_malloc,CRYPTO_realloc,BIO_gets,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F5C0 BUF_strdup,BUF_strdup,CRYPTO_malloc,sk_push,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B95D0 CRYPTO_malloc,BUF_strdup,BUF_strdup,sk_new_null,sk_push,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110025E0 CRYPTO_realloc_clean,CRYPTO_malloc,OPENSSL_cleanse,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110595E0 BN_new,ERR_put_error,ASN1_item_new,X509_TRUST_get_flags,ENGINE_get_init_function,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,ASN1_OCTET_STRING_new,ASN1_OCTET_STRING_set,EC_GROUP_get_order,BN_to_ASN1_INTEGER,EC_GROUP_get_cofactor,BN_to_ASN1_INTEGER,ERR_put_error,ASN1_item_free,BN_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110175F0 DES_ecb3_encrypt,DES_encrypt3,DES_decrypt3,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110375F0 BN_CTX_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110925F0 ASN1_STRING_set0,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023400 AES_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031410 CRYPTO_gcm128_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032410 CRYPTO_ccm128_decrypt_ccm64,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11078410 EVP_PKEY_free,CRYPTO_add_lock,ENGINE_finish,X509_ATTRIBUTE_free,sk_pop_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B410 asn1_do_lock,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020420 BF_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F420 SEED_cfb128_encrypt,SEED_encrypt,CRYPTO_cfb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11063420 BIO_new,CRYPTO_malloc,ERR_put_error,BIO_set,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E420 X509_PKEY_new,CRYPTO_malloc,X509_ALGOR_new,ASN1_STRING_type_new,X509_PKEY_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F430 ERR_print_errors_cb,CRYPTO_THREADID_current,X509_TRUST_get_flags,ERR_get_error_line_data,ERR_error_string_n,BIO_snprintf,ERR_get_error_line_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C440 DES_fcrypt,_memset,DES_set_key_unchecked,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11066440 CRYPTO_malloc,CRYPTO_realloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A440 sk_insert,CRYPTO_realloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072440 EVP_DecryptFinal_ex,ERR_put_error,ERR_put_error,OpenSSLDie,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002450 CRYPTO_free_locked,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F460 SEED_ofb128_encrypt,SEED_encrypt,CRYPTO_ofb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081470 BN_to_ASN1_ENUMERATED,ASN1_STRING_type_new,BN_num_bits,CRYPTO_realloc,ERR_put_error,ASN1_STRING_free,BN_bn2bin,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037480 CRYPTO_malloc,BN_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A480 RSA_setup_blinding,BN_CTX_new,BN_CTX_start,BN_CTX_get,ERR_put_error,ERR_put_error,RAND_status,RAND_add,BN_BLINDING_create_param,ERR_put_error,BN_BLINDING_thread_id,CRYPTO_THREADID_current,BN_CTX_end,BN_CTX_free,BN_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7480 CMS_RecipientEncryptedKey_cert_cmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002490 CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F490 CRYPTO_cbc128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038490 bn_expand2,CRYPTO_malloc,bn_sub_words,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11078490 EVP_PKEY_encrypt_old,ERR_put_error,RSA_public_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B4A0 asn1_enc_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110854A0 i2d_X509_AUX,ASN1_item_i2d,i2d_X509_CERT_AUX,CRYPTO_malloc,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B94B0 sk_new_null,CRYPTO_malloc,BUF_strdup,sk_push,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108A4C0 ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,BUF_MEM_grow_clean,ERR_put_error,ERR_put_error,ERR_put_error,asn1_ex_c2i,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110704D0 OBJ_create,a2d_ASN1_OBJECT,CRYPTO_malloc,ERR_put_error,a2d_ASN1_OBJECT,ASN1_OBJECT_create,OBJ_add_object,ASN1_OBJECT_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D4D0 EVP_PKEY_derive_set_peer,ERR_put_error,EVP_PKEY_missing_parameters,EVP_PKEY_cmp_parameters,ERR_put_error,EVP_PKEY_free,CRYPTO_add_lock,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110014E0 CRYPTO_get_new_lockid,sk_new_null,ERR_put_error,BUF_strdup,sk_push,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106C4E0 GetVersion,OPENSSL_isservice,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,GetObjectA,CRYPTO_malloc,GetDIBits,EVP_sha1,EVP_Digest,RAND_add,CRYPTO_free,DeleteObject,ReleaseDC,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110784E0 EVP_PKEY_decrypt_old,ERR_put_error,RSA_private_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110634F0 BIO_dup_chain,CRYPTO_malloc,BIO_set,BIO_ctrl,CRYPTO_dup_ex_data,BIO_push,CRYPTO_free,ERR_put_error,BIO_free,BIO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C4F0 EVP_PKEY_CTX_free,EVP_PKEY_free,EVP_PKEY_free,ENGINE_finish,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B4F0 asn1_enc_save,CRYPTO_free,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001700 CRYPTO_get_dynlock_destroy_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A700 sk_dup,sk_new,CRYPTO_realloc,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077700 EVP_SealInit,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,EVP_CIPHER_CTX_rand_key,X509_get_issuer_name,X509_get_issuer_name,RAND_bytes,EVP_EncryptInit_ex,X509_STORE_CTX_get0_policy_tree,EVP_PKEY_encrypt_old,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9700 CONF_get1_default_config_file,ossl_safe_getenv,BUF_strdup,X509_get_default_cert_area,CRYPTO_malloc,X509_get_default_cert_area,BUF_strlcpy,BUF_strlcat,BUF_strlcat,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001710 CRYPTO_set_dynlock_create_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101D710 RC2_ecb_encrypt,RC2_encrypt,RC2_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094710 PEM_SignFinal,EVP_PKEY_size,CRYPTO_malloc,ERR_put_error,EVP_SignFinal,EVP_EncodeBlock,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C4710 ENGINE_pkey_asn1_find_str,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002720 CRYPTO_set_mem_debug_options,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001720 CRYPTO_set_dynlock_lock_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A720 Camellia_ctr128_encrypt,Camellia_encrypt,CRYPTO_ctr128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036720 ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045720 RSA_padding_check_PKCS1_type_2,CRYPTO_malloc,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002730 CRYPTO_get_mem_debug_options,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001730 CRYPTO_set_dynlock_destroy_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044730 RSA_new_method,CRYPTO_malloc,ERR_put_error,_memset,RSA_PKCS1_SSLeay,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_RSA,UI_get0_user_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052730 CMS_SharedInfo_encode,CRYPTO_memcmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072730 EVP_CIPHER_CTX_copy,ENGINE_init,ERR_put_error,EVP_CIPHER_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082730 ASN1_mbstring_ncopy,UTF8_getc,ERR_put_error,BIO_snprintf,ERR_add_error_data,ERR_put_error,BIO_snprintf,ERR_add_error_data,CRYPTO_free,ASN1_STRING_type_new,ASN1_STRING_set,CRYPTO_malloc,ASN1_STRING_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002740 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001740 CRYPTO_get_locking_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001750 CRYPTO_get_add_lock_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088750 ASN1_template_new,ASN1_primitive_new,CRYPTO_malloc,_memset,asn1_set_choice_selector,CRYPTO_malloc,_memset,asn1_do_lock,asn1_enc_init,asn1_get_field_ptr,ASN1_template_new,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C1750 ERR_put_error,CRYPTO_add_lock,CRYPTO_free_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003760 CRYPTO_mem_leaks_fp,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,BIO_s_file,BIO_new,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,BIO_ctrl,CRYPTO_mem_leaks,BIO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001760 CRYPTO_set_locking_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D760 ERR_free_strings,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E760 i2a_ASN1_OBJECT,OBJ_obj2txt,CRYPTO_malloc,OBJ_obj2txt,BIO_write,BIO_write,CRYPTO_free,BIO_write,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A6760 string_to_hex,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002770 CRYPTO_mem_ctrl,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001770 CRYPTO_set_add_lock_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040770 BN_GF2m_mod_mul,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_mul_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001780 CRYPTO_THREADID_set_numeric,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062780 BUF_MEM_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001790 CRYPTO_THREADID_set_pointer,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061790 ECDSA_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A790 sk_deep_copy,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F790 OBJ_NAME_remove,lh_delete,sk_num,sk_value,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017A0 CRYPTO_THREADID_set_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110227B0 CAST_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110947B0 PEM_SealInit,RSA_size,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_EncodeInit,EVP_MD_CTX_init,EVP_DigestInit,EVP_CIPHER_CTX_init,EVP_SealInit,RSA_size,EVP_EncodeBlock,CRYPTO_free,OPENSSL_cleanse,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017C0 CRYPTO_THREADID_get_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110627C0 BUF_MEM_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D7C0 ERR_get_string_table,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017D0 CRYPTO_THREADID_current,GetCurrentThreadId,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110897E0 sk_num,sk_num,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,sk_num,sk_value,ASN1_item_ex_i2d,sk_num,sk_num,sk_value,ASN1_item_ex_i2d,sk_num,sk_num,sk_num,sk_num,sk_num,sk_set,sk_num,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110707F0 OBJ_obj2txt,OBJ_obj2nid,OBJ_nid2ln,OBJ_nid2sn,BUF_strlcpy,BN_add_word,BN_new,BN_set_word,BN_lshift,BN_sub_word,BN_bn2dec,BUF_strlcpy,CRYPTO_free,BIO_snprintf,BUF_strlcpy,BN_free,BN_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A600 Camellia_ecb_encrypt,Camellia_encrypt,Camellia_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102E600 SEED_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032600 CRYPTO_xts128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061600 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F600 OBJ_NAME_new_index,CRYPTO_mem_ctrl,sk_new_null,CRYPTO_mem_ctrl,sk_num,CRYPTO_mem_ctrl,CRYPTO_malloc,CRYPTO_mem_ctrl,CRYPTO_mem_ctrl,sk_push,CRYPTO_mem_ctrl,sk_value,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C610 DES_crypt,DES_fcrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036610 BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A610 sk_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088610 ASN1_primitive_new,OBJ_nid2obj,CRYPTO_malloc,ASN1_STRING_type_new,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11095620 PEM_do_header,PEM_def_callback,ERR_put_error,d2i_X509,EVP_md5,EVP_BytesToKey,EVP_CIPHER_CTX_init,EVP_DecryptInit_ex,EVP_DecryptUpdate,EVP_DecryptFinal_ex,EVP_CIPHER_CTX_cleanup,OPENSSL_cleanse,OPENSSL_cleanse,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C630 DES_xcbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A630 Camellia_ofb128_encrypt,Camellia_encrypt,CRYPTO_ofb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F630 CRYPTO_cbc128_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062630 ECDSA_verify,ECDSA_SIG_new,d2i_ECDSA_SIG,i2d_ECDSA_SIG,OPENSSL_cleanse,CRYPTO_free,ECDSA_SIG_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092630 ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1109B650 X509_NAME_oneline,BUF_MEM_new,BUF_MEM_grow,CRYPTO_free,_strncpy,sk_num,CRYPTO_free,sk_value,OBJ_obj2nid,OBJ_nid2sn,i2t_ASN1_OBJECT,BUF_MEM_grow,sk_num,ERR_put_error,BUF_MEM_free,ERR_put_error,BUF_MEM_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001660 CRYPTO_get_dynlock_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F660 idea_cfb64_encrypt,idea_encrypt,idea_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A660 Camellia_cfb128_encrypt,Camellia_encrypt,CRYPTO_cfb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036670 BN_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031670 CRYPTO_gcm128_encrypt_ctr32,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092680 ASN1_STRING_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107F690 ASN1_GENERALIZEDTIME_adj,ASN1_STRING_type_new,OPENSSL_gmtime,OPENSSL_gmtime_adj,CRYPTO_malloc,ERR_put_error,CRYPTO_free,BIO_snprintf,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7690 CMS_RecipientInfo_kari_decrypt,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110196A0 DES_pcbc_encrypt,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A6A0 Camellia_cfb1_encrypt,Camellia_encrypt,CRYPTO_cfb128_1_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110586A0 pqueue_peek,ENGINE_get_pkey_asn1_meths,X509_TRUST_get_flags,EVP_MD_block_size,ENGINE_get_finish_function,BN_CTX_start,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_CTX_get,X509_TRUST_get_flags,EC_GROUP_get_order,CRYPTO_free,BN_CTX_end,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D6A0 CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E6A0 i2d_ASN1_BOOLEAN,ASN1_object_size,CRYPTO_malloc,ERR_put_error,ASN1_put_object,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110806B0 i2d_ASN1_SET,sk_num,sk_value,sk_value,ASN1_object_size,ASN1_put_object,sk_num,sk_num,CRYPTO_malloc,sk_num,sk_value,sk_num,sk_num,CRYPTO_malloc,ERR_put_error,sk_num,sk_num,CRYPTO_free,CRYPTO_free,sk_num,sk_value,sk_num,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110876B0 X509_NAME_print,X509_NAME_oneline,CRYPTO_free,BIO_write,BIO_write,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110926B0 ASN1_STRING_clear_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C16B0 ENGINE_new,CRYPTO_malloc,ERR_put_error,_memset,CRYPTO_new_ex_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110026D0 CRYPTO_remalloc,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110176D0 DES_cfb64_encrypt,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110366D0 BN_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110776D0 EVP_OpenFinal,EVP_DecryptFinal_ex,EVP_DecryptInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110016E0 CRYPTO_get_dynlock_create_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A6E0 Camellia_cfb8_encrypt,Camellia_encrypt,CRYPTO_cfb128_8_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110966E0 PEM_ASN1_write_bio,pqueue_peek,OBJ_nid2sn,X509_TRUST_get0_name,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PEM_def_callback,ERR_put_error,RAND_add,OpenSSLDie,RAND_bytes,EVP_md5,EVP_BytesToKey,OPENSSL_cleanse,OpenSSLDie,PEM_proc_type,PEM_dek_info,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal_ex,EVP_CIPHER_CTX_cleanup,PEM_write_bio,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110016F0 CRYPTO_get_dynlock_lock_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E6F0 DSO_convert_filename,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003900 CRYPTO_mem_leaks_cb,CRYPTO_lock,lh_doall_arg,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F900 CRYPTO_ctr128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067900 BIO_get_port,ERR_put_error,CRYPTO_lock,getservbyname,htons,CRYPTO_lock,WSAGetLastError,ERR_put_error,ERR_add_error_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E910 idea_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030910 CRYPTO_cfb128_1_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053910 EC_GROUP_precompute_mult,X509_TRUST_get_flags,BN_CTX_new,BN_CTX_start,BN_CTX_get,EC_GROUP_get_order,BN_num_bits,CRYPTO_malloc,EC_POINT_new,EC_POINT_new,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_copy,EC_POINT_add,EC_POINT_dbl,EC_POINT_dbl,EC_POINTs_make_affine,ERR_put_error,BN_CTX_end,BN_CTX_free,EC_POINT_free,CRYPTO_free,EC_POINT_free,EC_POINT_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11059920 BN_bin2bn,ERR_put_error,BN_bin2bn,OBJ_obj2nid,ERR_put_error,BN_new,ERR_put_error,OBJ_obj2nid,ERR_put_error,ASN1_INTEGER_get,BN_set_bit,ERR_put_error,ERR_put_error,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,EC_GROUP_new_curve_GF2m,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ASN1_INTEGER_to_BN,ERR_put_error,BN_num_bits,ERR_put_error,EC_GROUP_new_curve_GFp,ERR_put_error,CRYPTO_free,CRYPTO_malloc,EC_POINT_new,EC_GROUP_set_point_conversion_form,EC_POINT_oct2point,ASN1_INTEGER_to_BN,BN_num_bits,ERR_put_error,EC_GROUP_free,EC_GROUP_free,BN_free,BN_free,BN_free,EC_POINT_free,BN_CTX_free,BN_free,EC_GROUP_set_generator,ASN1_INTEGER_to_BN,BN_CTX_new,EC_GROUP_dup,EC_GROUP_set_seed,EC_GROUP_set_generator,EC_GROUP_new_by_curve_name,EC_GROUP_free,EC_GROUP_set_asn1_flag,EC_GROUP_set_seed,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014940 CMAC_CTX_new,CRYPTO_malloc,EVP_CIPHER_CTX_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002950 CRYPTO_dbg_set_options,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002960 CRYPTO_dbg_get_options,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D960 ERR_func_error_string,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E980 c2i_ASN1_OBJECT,ASN1_OBJECT_new,ERR_put_error,CRYPTO_free,CRYPTO_malloc,ERR_put_error,ASN1_OBJECT_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094980 PEM_SealUpdate,EVP_DigestUpdate,EVP_EncryptUpdate,EVP_EncodeUpdate,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110039A0 CRYPTO_get_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110309B0 CRYPTO_cfb128_8_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110329B0 CRYPTO_128_wrap,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A9C0 DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104B9C0 DSA_new_method,CRYPTO_malloc,ERR_put_error,DSA_OpenSSL,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_DSA,X509_TRUST_get0_name,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C9C0 EVP_PKEY_meth_get_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110369D0 BN_set_word,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A9D0 sk_pop_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110719D0 EVP_MD_CTX_create,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110939D0 ASN1_pack_string,ASN1_STRING_new,ERR_put_error,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110149E0 CMAC_CTX_free,CMAC_CTX_cleanup,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C9E0 EVP_PKEY_meth_get_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110899E0 ASN1_item_ex_i2d,CRYPTO_malloc,ASN1_item_ex_i2d,ASN1_item_ex_i2d,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110029F0 CRYPTO_THREADID_current,lh_delete,lh_insert,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110039F0 CRYPTO_set_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110449F0 RSA_up_ref,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D9F0 ERR_reason_error_string,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110819F0 ASN1_sign,EVP_MD_CTX_init,ASN1_TYPE_free,ASN1_TYPE_free,ASN1_TYPE_new,ASN1_OBJECT_free,OBJ_nid2obj,CRYPTO_malloc,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_SignFinal,CRYPTO_free,ERR_put_error,EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061800 ECDSA_METHOD_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062800 BUF_MEM_grow,_memset,ERR_put_error,CRYPTO_malloc,CRYPTO_realloc,ERR_put_error,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11091800 sk_new_null,X509V3_get_section,sk_num,sk_value,sk_push,sk_num,i2d_ASN1_SET_ANY,i2d_ASN1_SEQUENCE_ANY,ASN1_TYPE_new,ASN1_STRING_type_new,CRYPTO_free,ASN1_TYPE_free,sk_pop_free,X509V3_section_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001810 CRYPTO_THREADID_cmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A820 Camellia_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036820 bn_expand2,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040820 BN_GF2m_mod_sqr,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_sqr_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D820 ERR_get_err_state_table,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C830 EVP_PKEY_meth_set_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018840 DES_ede3_ofb64_encrypt,DES_encrypt3,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020840 BF_cbc_encrypt,BF_encrypt,BF_decrypt,BF_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026840 AES_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102D840 SEED_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C1840 sk_new_null,CRYPTO_malloc,sk_push,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052850 DH_KDF_X9_42,EVP_MD_size,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal,OPENSSL_cleanse,CRYPTO_free,EVP_MD_CTX_cleanup,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072850 EVP_CipherInit_ex,EVP_CIPHER_CTX_cleanup,ENGINE_init,ERR_put_error,ENGINE_get_cipher_engine,ENGINE_get_cipher,CRYPTO_malloc,ERR_put_error,EVP_CIPHER_CTX_ctrl,ERR_put_error,OpenSSLDie,EVP_CIPHER_CTX_flags,ERR_put_error,EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,X509_get_issuer_name,OpenSSLDie,X509_get_issuer_name,X509_get_issuer_name,X509_get_issuer_name,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C850 EVP_PKEY_meth_set_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F860 idea_ofb64_encrypt,idea_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001870 CRYPTO_THREADID_cpy,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031870 CRYPTO_gcm128_decrypt_ctr32,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104F870 d2i_DHxparams,DH_new,ASN1_item_d2i,DH_free,DH_free,ASN1_BIT_STRING_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E870 ASN1_OBJECT_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077870 EVP_SealFinal,EVP_EncryptFinal_ex,EVP_EncryptInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D880 ERR_release_err_state_table,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001890 CRYPTO_get_id_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018A0 CRYPTO_set_id_callback,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110238A0 AES_bi_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018B0 CRYPTO_thread_id,GetCurrentThreadId,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E8B0 ERR_peek_error,ERR_get_state,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D8B0 i2d_RSA_NET,EVP_CIPHER_CTX_init,ASN1_item_new,ASN1_item_new,OBJ_nid2obj,ASN1_TYPE_new,i2d_RSAPrivateKey,ASN1_item_i2d,OBJ_nid2obj,ASN1_TYPE_new,CRYPTO_malloc,ERR_put_error,i2d_RSAPrivateKey,CRYPTO_malloc,ASN1_STRING_set,OPENSSL_cleanse,ERR_put_error,EVP_md5,EVP_Digest,EVP_md5,EVP_rc4,EVP_BytesToKey,OPENSSL_cleanse,EVP_rc4,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal_ex,EVP_CIPHER_CTX_cleanup,ASN1_item_free,ASN1_item_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110178C0 DES_ede3_cfb64_encrypt,DES_encrypt3,DES_encrypt3,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E8C0 ASN1_OBJECT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110028D0 CRYPTO_is_mem_check_on,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_THREADID_cmp,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018D0 CRYPTO_get_lock_name,sk_num,sk_value,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110448D0 RSA_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_BLINDING_free,BN_BLINDING_free,CRYPTO_free_locked,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110938D0 ASN1_seq_pack,i2d_ASN1_SET,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_ASN1_SET,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110958D0 PEM_write_bio,EVP_EncodeInit,BIO_write,BIO_write,BIO_write,BIO_write,BIO_write,CRYPTO_malloc,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,EVP_EncodeUpdate,BIO_write,EVP_EncodeFinal,BIO_write,OPENSSL_cleanse,CRYPTO_free,BIO_write,BIO_write,BIO_write,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101D8E0 RC2_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D8E0 ERR_lib_error_string,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110628E0 BUF_MEM_grow_clean,_memset,_memset,ERR_put_error,CRYPTO_malloc,CRYPTO_realloc_clean,ERR_put_error,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110268F0 AES_cbc_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F8F0 OBJ_NAME_do_all_sorted,lh_num_items,CRYPTO_malloc,lh_doall_arg,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103EB00 BN_RECP_CTX_free,BN_free,BN_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11013B10 DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FB10 idea_set_encrypt_key,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AB10 EC_KEY_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108FB10 BUF_strdup,BUF_strdup,CRYPTO_malloc,sk_new,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AB20 DES_encrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BB20 DSA_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053B30 EC_GROUP_clear_free,BN_MONT_CTX_free,EC_POINT_clear_free,BN_clear_free,BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DB30 ERR_remove_state,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072B30 EVP_CipherUpdate,EVP_DecryptUpdate,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088B30 ASN1_primitive_free,ASN1_OBJECT_free,ASN1_primitive_free,CRYPTO_free,ASN1_STRING_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038B40 BN_bn2hex,CRYPTO_strdup,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031B40 CRYPTO_gcm128_tag,CRYPTO_gcm128_finish,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AB40 CRYPTO_realloc,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11095B40 PEM_read_bio,BUF_MEM_new,BUF_MEM_new,BUF_MEM_new,BIO_gets,_strncmp,_strncmp,BIO_gets,BUF_MEM_grow,BUF_MEM_grow,BIO_gets,BUF_MEM_grow,_strncmp,BIO_gets,BUF_MEM_grow,BIO_gets,_strncmp,BUF_MEM_grow_clean,BIO_gets,BIO_gets,_strncmp,_strncmp,_strncmp,EVP_DecodeInit,EVP_DecodeUpdate,EVP_DecodeFinal,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080B50 ASN1_dup,CRYPTO_malloc,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11058B60 EC_POINT_point2bn,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,CRYPTO_free,BN_bin2bn,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AB70 EC_KEY_free,CRYPTO_add_lock,EC_GROUP_free,EC_POINT_free,BN_clear_free,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DB80 RC2_cbc_encrypt,RC2_encrypt,RC2_encrypt,RC2_decrypt,RC2_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031B80 CRYPTO_gcm128_new,CRYPTO_malloc,CRYPTO_gcm128_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072B80 EVP_EncryptInit_ex,EVP_CipherInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FB90 CRYPTO_cts128_encrypt_block,CRYPTO_cbc128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107CB90 EVP_PKEY_CTX_new,ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092BA0 d2i_ASN1_type_bytes,ASN1_get_object,ASN1_tag2bit,d2i_ASN1_BIT_STRING,ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DBB0 ERR_get_state,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cpy,CRYPTO_malloc,CRYPTO_THREADID_cpy,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072BB0 EVP_DecryptInit_ex,EVP_CipherInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094BB0 PEM_X509_INFO_read_bio,sk_new_null,ERR_put_error,X509_INFO_new,PEM_read_bio,sk_push,X509_INFO_new,X509_PKEY_new,X509_PKEY_new,X509_PKEY_new,PEM_get_EVP_CIPHER_INFO,PEM_do_header,d2i_PrivateKey,d2i_X509,ERR_put_error,X509_INFO_free,sk_num,sk_value,X509_INFO_free,sk_num,sk_free,PEM_get_EVP_CIPHER_INFO,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_last_error,ERR_clear_error,sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003BC0 CRYPTO_malloc,ERR_put_error,CRYPTO_lock,sk_num,sk_push,sk_num,sk_set,CRYPTO_lock,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031BC0 CRYPTO_gcm128_release,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044BC0 RSA_sign,ERR_put_error,OBJ_nid2obj,ERR_put_error,ERR_put_error,i2d_X509_SIG,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_X509_SIG,RSA_private_encrypt,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031BE0 CRYPTO_ccm128_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053BE0 EC_GROUP_copy,ERR_put_error,ERR_put_error,BN_MONT_CTX_new,BN_MONT_CTX_copy,BN_MONT_CTX_free,EC_POINT_new,EC_POINT_copy,EC_POINT_clear_free,BN_copy,BN_copy,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106FBE0 OBJ_NAME_add,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,CRYPTO_malloc,lh_insert,sk_num,sk_value,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080BE0 ASN1_item_dup,ASN1_item_i2d,ERR_put_error,ASN1_item_d2i,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11083BE0 X509_PUBKEY_get,CRYPTO_add_lock,EVP_PKEY_new,OBJ_obj2nid,EVP_PKEY_set_type,CRYPTO_lock,CRYPTO_lock,EVP_PKEY_free,CRYPTO_lock,CRYPTO_add_lock,ERR_put_error,EVP_PKEY_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CBF0 DES_cbc_cksum,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056BF0 CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11058BF0 EC_POINT_bn2point,BN_num_bits,CRYPTO_malloc,BN_bn2bin,CRYPTO_free,EC_POINT_new,EC_POINT_oct2point,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CA00 Camellia_cbc_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030A00 CRYPTO_ofb128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AA00 i2o_ECPublicKey,ERR_put_error,EC_POINT_point2oct,CRYPTO_malloc,ERR_put_error,EC_POINT_point2oct,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071A00 EVP_DigestInit_ex,EVP_MD_CTX_clear_flags,ENGINE_finish,ENGINE_init,ERR_put_error,ENGINE_get_digest_engine,ENGINE_get_digest,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DA20 RC2_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044A20 RSA_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AA20 lh_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003A40 CRYPTO_lock,pqueue_peek,lh_new,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107CA40 ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FA50 CRYPTO_ctr128_encrypt_ctr32,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052A50 EC_GROUP_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BN_init,BN_init,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106EA50 ERR_peek_error_line,ERR_get_state,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FA60 idea_ecb_encrypt,idea_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062A60 BUF_strndup,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094A60 PEM_SealFinal,ERR_put_error,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_EncryptFinal_ex,EVP_EncodeUpdate,EVP_EncodeFinal,EVP_SignFinal,EVP_EncodeBlock,EVP_MD_CTX_cleanup,EVP_CIPHER_CTX_cleanup,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002A70 CRYPTO_push_info_,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_malloc,lh_new,CRYPTO_free,CRYPTO_THREADID_current,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018A70 DES_enc_read,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,__read,__read,DES_pcbc_encrypt,DES_cbc_encrypt,DES_pcbc_encrypt,DES_cbc_encrypt,DES_pcbc_encrypt,DES_cbc_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031A70 CRYPTO_gcm128_finish,CRYPTO_memcmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044A70 RSA_memory_lock,CRYPTO_malloc_locked,ERR_put_error,BN_clear_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020A80 BF_cfb64_encrypt,BF_encrypt,BF_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053A90 EC_GROUP_free,BN_MONT_CTX_free,CRYPTO_free,BN_free,BN_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003AA0 ASN1_PCTX_free,sk_pop_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014AA0 CMAC_Init,EVP_EncryptInit_ex,X509_get_serialNumber,_memset,EVP_EncryptInit_ex,pqueue_peek,EVP_CIPHER_CTX_set_key_length,EVP_EncryptInit_ex,X509_get_serialNumber,EVP_Cipher,OPENSSL_cleanse,EVP_EncryptInit_ex,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DAA0 ERR_remove_thread_state,CRYPTO_THREADID_cpy,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11093AA0 ASN1_item_pack,ASN1_STRING_new,ERR_put_error,CRYPTO_free,ASN1_item_i2d,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103EAB0 BN_RECP_CTX_new,CRYPTO_malloc,BN_init,BN_init,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003AC0 CRYPTO_lock,lh_retrieve,CRYPTO_malloc,sk_new_null,CRYPTO_free,lh_insert,lh_retrieve,sk_free,CRYPTO_free,CRYPTO_lock,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AAC0 DES_encrypt2,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092AD0 ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D3AD0 CRYPTO_malloc,BUF_strdup,BN_bin2bn,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017AE0 DES_ede3_cfb_encrypt,DES_encrypt3,DES_encrypt3,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062AE0 BUF_memdup,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11089AE0 asn1_ex_c2i,ASN1_TYPE_new,ASN1_TYPE_set,c2i_ASN1_OBJECT,ERR_put_error,ASN1_TYPE_free,c2i_ASN1_BIT_STRING,c2i_ASN1_INTEGER,ASN1_STRING_type_new,CRYPTO_free,ASN1_STRING_set,ERR_put_error,ASN1_STRING_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032AF0 CRYPTO_128_unwrap,OPENSSL_cleanse,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045AF0 RSA_padding_check_SSLv23,CRYPTO_malloc,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106FAF0 OBJ_NAME_init,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072D20 EVP_DecryptInit,_memset,EVP_CipherInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11070D30 OBJ_txt2obj,OBJ_sn2nid,OBJ_ln2nid,OBJ_nid2obj,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052D40 EC_GROUP_set_seed,CRYPTO_free,CRYPTO_malloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DD40 ERR_set_error_data,ERR_get_state,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077D40 EVP_PKEY_new,CRYPTO_malloc,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071D50 EVP_MD_CTX_copy_ex,ENGINE_init,ERR_put_error,EVP_MD_CTX_set_flags,EVP_MD_CTX_cleanup,EVP_PKEY_CTX_dup,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018D60 DES_enc_write,CRYPTO_malloc,DES_enc_write,RAND_bytes,_shadow_DES_rw_mode,DES_pcbc_encrypt,DES_cbc_encrypt,__locking,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031D60 CRYPTO_ccm128_encrypt,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056D60 CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,BN_is_bit_set,ERR_put_error,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AD70 EC_KEY_up_ref,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11084D70 CRYPTO_free,sk_num,sk_new_null,sk_num,sk_value,sk_new_null,sk_push,ASN1_item_new,OBJ_dup,sk_push,sk_num,CRYPTO_malloc,sk_free,ASN1_item_free,sk_pop_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11096D70 PEM_bytes_read_bio,PEM_read_bio,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_error,ERR_add_error_data,PEM_get_EVP_CIPHER_INFO,PEM_do_header,CRYPTO_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AD80 DES_ncbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FD80 BF_set_key,BF_encrypt,BF_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023D80 AES_wrap_key,AES_encrypt,CRYPTO_128_wrap,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107ED80 ASN1_BIT_STRING_set_bit,CRYPTO_malloc,CRYPTO_realloc_clean,ERR_put_error,_memset,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001D90 CRYPTO_memcmp,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002D90 CRYPTO_remove_all_info,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003D90 CRYPTO_ex_data_new_class,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AD90 lh_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067D90 BIO_accept,accept,BIO_sock_should_retry,WSAGetLastError,ERR_put_error,ERR_put_error,DSO_global_lookup,htonl,htons,CRYPTO_malloc,ERR_put_error,BIO_snprintf,CRYPTO_realloc,CRYPTO_malloc,BIO_snprintf,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FDA0 CRYPTO_nistcts128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046DA0 RSA_verify_PKCS1_PSS_mgf1,EVP_MD_CTX_init,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PKCS1_MGF1,ERR_put_error,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,ERR_put_error,CRYPTO_free,EVP_MD_CTX_cleanup,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DDA0 ERR_add_error_vdata,CRYPTO_malloc,CRYPTO_realloc,BUF_strlcat,ERR_get_state,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023DB0 AES_unwrap_key,AES_decrypt,CRYPTO_128_unwrap,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11060DB0 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107FDB0 c2i_ASN1_INTEGER,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001DC0 CRYPTO_lock,CRYPTO_get_dynlock_value,CRYPTO_destroy_dynlockid,OpenSSLDie,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CDC0 DES_ede3_cbcm_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014DC0 CMAC_resume,EVP_EncryptInit_ex,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092DC0 ASN1_STRING_new,ASN1_get_object,CRYPTO_malloc,ASN1_STRING_free,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044DD0 i2d_X509_SIG,OPENSSL_cleanse,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003DF0 CRYPTO_cleanup_all_ex_data,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BC00 DSA_up_ref,CRYPTO_add_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072C00 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_cleanup,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088C10 ASN1_template_free,ASN1_primitive_free,asn1_get_choice_selector,asn1_get_field_ptr,ASN1_template_free,asn1_do_lock,asn1_enc_free,asn1_do_adb,asn1_get_field_ptr,ASN1_template_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038C20 BN_bn2dec,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,BN_dup,BN_div_word,BIO_snprintf,BIO_snprintf,CRYPTO_free,BN_free,CRYPTO_free,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A0C2E sk_value,sk_num,CRYPTO_malloc,sk_push,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AC20 CRYPTO_realloc,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A5C20 X509V3_EXT_print,X509V3_EXT_get,ASN1_item_d2i,BIO_printf,X509V3_EXT_val_prn,X509V3_conf_free,sk_pop_free,CRYPTO_free,ASN1_item_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FC30 CRYPTO_nistcts128_encrypt_block,CRYPTO_cbc128_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031C30 CRYPTO_ccm128_setiv,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D3C3E sk_value,sk_num,sk_insert,CRYPTO_free,BN_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106EC30 ERR_peek_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002C40 CRYPTO_pop_info,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062C40 BIO_set,CRYPTO_new_ex_data,CRYPTO_free_ex_data,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071C40 EVP_MD_CTX_cleanup,EVP_MD_CTX_test_flags,EVP_MD_CTX_test_flags,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,ENGINE_finish,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081C40 ASN1_item_sign_ctx,X509_NAME_ENTRY_get_object,UI_get0_user_data,EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,pqueue_peek,OBJ_find_sigid_by_algs,OBJ_nid2obj,X509_ALGOR_set0,OBJ_nid2obj,X509_ALGOR_set0,ASN1_item_i2d,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9C40 CONF_modules_load_file,NCONF_new,CONF_get1_default_config_file,NCONF_load,ERR_peek_last_error,ERR_clear_error,CONF_modules_load,CRYPTO_free,NCONF_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AC50 DES_decrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022C50 CAST_cbc_encrypt,CAST_encrypt,CAST_decrypt,CAST_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102AC50 Camellia_decrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107EC50 c2i_ASN1_BIT_STRING,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020C80 BF_ofb64_encrypt,BF_encrypt,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BC90 DSA_get_ex_new_index,CRYPTO_get_ex_new_index,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056C90 CRYPTO_add_lock,EC_POINT_free,CRYPTO_free,CRYPTO_free,

Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Unpacked PE file: 4.2.rfusclient.exe.650000.0.unpack

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

File created: C:\ProgramData\Remote Utilities\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000000.1646535165.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\msiexec.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB240CC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4FB80 FindFirstFileExA,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004940 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D9950 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 101.99.94.54 ports 5651,1,465,5,6,80

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 185.70.104.90:5651
Source: global traffic	TCP traffic: 192.168.2.4:49735 -> 101.99.94.54:5651
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 77.105.132.70:5651
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 64.20.61.146:5655
Source: global traffic	TCP traffic: 192.168.2.4:49818 -> 66.23.226.254:5655

Source: Joe Sandbox View	IP Address: 77.105.132.70 77.105.132.70
Source: Joe Sandbox View	IP Address: 64.20.61.146 64.20.61.146
Source: Joe Sandbox View	IP Address: 185.70.104.90 185.70.104.90
Source: Joe Sandbox View	IP Address: 66.23.226.254 66.23.226.254

Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54

Source: unknown

DNS traffic detected: queries for: id72.remoteutilities.com

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: rutserv.exe, 00000009.00000002.2987513831.00000000066C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: rutserv.exe, 00000009.00000003.1919101620.0000000006708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/
Source: rutserv.exe, 00000009.00000003.1919101620.00000000066E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/G
Source: rutserv.exe, 00000009.00000003.2512955936.00000000066CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSE67Nbq3jfQQg8yXEpbmqLTNn7XwQUm1%2BwNrqdBq4ZJ
Source: rutserv.exe, 00000009.00000003.1921331716.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2511488577.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuN
Source: rutserv.exe, 00000009.00000002.2987878555.00000000066EB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919101620.00000000066E8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.00000000066EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/O
Source: rutserv.exe, 00000009.00000003.1919101620.0000000006708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/p
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0W
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rutserv.exe, 00000009.00000002.2987513831.00000000066C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.coma
Source: rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2704405939.0000000002026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crlhttp
Source: rutserv.exe, 00000009.00000002.2902670220.0000000001FFF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2511488577.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG3.crl
Source: rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade.ini
Source: rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade_beta.ini
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 00000004.00000003.1728446387.00000000033EC000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000004.00000000.1714769466.0000000000E4E000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.000000000122A000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000002.2909594242.0000000002675000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: rutserv.exe, 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=app
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=app?src=app
Source: rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=appx.php?src=app0
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/0
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/a0
Source: rutserv.exe, 00000009.00000002.2971300777.000000000503E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/connecting-over-the-internet/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/e
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/o0
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/rt/docs/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/rt/docs/r
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/s0
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/t0
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php.
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php...
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php1
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpB
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpdo?
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpes.
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpet
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpet
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpum
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpken

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3			Jump to dropped file
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB1C300: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\49a7b6.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIAB6F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB31E00
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB15E2C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3CD68
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB24938
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB40634
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1F8E8
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2A45C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB33364
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2AEC4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2F0F0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB320B0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB51F60
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB48AFC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB34A78
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB11AA4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB21A54
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB559D8
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB32990
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4F974
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB40634
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB38CD4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB32C38
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2BB3C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB25B70
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4C718
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB176C0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1A664
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2C918
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB48880
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB14840
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB33844
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1A2FC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1C300
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB352D0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB17288
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB211CC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2B4E0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB52430
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11024160
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F170
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040170
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110311A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110171B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005050
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E060
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110370E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E360
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11024370
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11035210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027260
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11015270
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A2A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110252B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E9507
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030510
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019540
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11008560
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E858B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023400
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E740B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110364A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E780
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110227B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102E600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E0610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103D640
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E640
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F660
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A680
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110196A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110176D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E900
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026906
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E910
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007940
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E794F
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101B980
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110329B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A9C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110339DD
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102D840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081850
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F860
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110238A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A8A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110178C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11013B10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030B10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AB20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019B80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DB80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007B90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103DBD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CBF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025A00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AA2C
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11016A40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CA5F
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020A80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005AC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017AE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031D60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CD70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CDC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AC50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005C80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020C80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11008C89
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031CA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102ACD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103FF10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018F60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DDF75
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026FA9
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007FC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031FC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11034FE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023E00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022E80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E7E93
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12011220
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12014290
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1201E2A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010BD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203E0A2
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203B947
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203BE8B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010E8B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1201177E
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203B403
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12002CC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120124C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120394ED
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010D70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12011578
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203C583
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1200EDA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_00481183

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11002490 appears 200 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12031BA4 appears 39 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 1106FBE0 appears 40 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11067450 appears 116 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11063420 appears 31 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12031898 appears 72 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11088AF0 appears 48 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12032150 appears 149 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11001DC0 appears 145 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11088E80 appears 50 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 110D46A0 appears 468 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 110DF348 appears 45 times

Source: rutserv.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.2.dr	Static PE information: Resource name: MAD type: DOS executable (COM, 0x8C-variant)
Source: rfusclient.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unires_vpd.dll.2.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: unidrvui_rupd.dll0.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unires_vpd.dll0.2.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: rutserv.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: unires_vpd.dll0.2.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll.2.dr	Static PE information: No import functions for PE file found

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll

Source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll0.2.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll.2.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/88@2/5

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB1B6E8 GetLastError,FormatMessageW,LocalFree,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_1106C670 RAND_poll,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetVersion,OPENSSL_isservice,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,GetVersion,GetVersion,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,RAND_add,Heap32First,RAND_add,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,RAND_add,GetTickCount,GetTickCount,GetTickCount,RAND_add,GetTickCount,GetTickCount,RAND_add,GetTickCount,FindCloseChangeNotification,FreeLibrary,GlobalMemoryStatus,RAND_add,GetCurrentProcessId,RAND_add,

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB38504 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$1ec4
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f84
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1dfc
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1ec4
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f84
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1dd8
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1f48
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e5c
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1398
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1db0

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4825296

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File read: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static file information: File size 20949417 > 1048576

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000000.1646535165.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Unpacked PE file: 4.2.rfusclient.exe.650000.0.unpack

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4825296

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: section name: .didat
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: section name: _RDATA
Source: vp8decoder.dll.2.dr	Static PE information: section name: .rodata
Source: vp8encoder.dll.2.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.2.dr	Static PE information: section name: _RDATA
Source: webmvorbisencoder.dll.2.dr	Static PE information: section name: _RDATA
Source: vccorlib120.dll.2.dr	Static PE information: section name: minATL
Source: rutserv.exe.2.dr	Static PE information: section name: .didata
Source: rfusclient.exe.2.dr	Static PE information: section name: .didata
Source: eventmsg.dll.2.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.2.dr	Static PE information: section name: minATL

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DF38D push ecx; ret
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12035721 push ecx; ret
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CBF79 push 34007CC2h; retn 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC270 push 34007CC2h; retn 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CCA5F pushfd ; retf 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC554 push 34007CC2h; retn 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC2B0 push 34007CC2h; retn 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CCBA9 pushfd ; retf 007Ch
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC2A0 push eax; ret

Source: msvcr120.dll.2.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: VPDAgent.exe.2.dr	Static PE information: section name: .text entropy: 6.812931691200469

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

File created: C:\ProgramData\Remote Utilities\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer Security

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 00000005.00000000.1736259820.0000000000D41000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEC
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE0
Source: rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXET
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEW

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_11004DE0 rdtsc

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Window / User API: threadDelayed 5772
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Window / User API: threadDelayed 1371
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Window / User API: threadDelayed 5216
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Window / User API: threadDelayed 4281

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

API coverage: 0.4 %

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7952	Thread sleep count: 5772 > 30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7952	Thread sleep time: -5772000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8004	Thread sleep time: -50000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8032	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8076	Thread sleep time: -180000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8084	Thread sleep time: -35000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8088	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8044	Thread sleep count: 1371 > 30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8092	Thread sleep time: -40000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8188	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7892	Thread sleep count: 38 > 30
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe TID: 7356	Thread sleep time: -2608000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe TID: 7356	Thread sleep time: -2140500s >= -30000s

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB240CC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4FB80 FindFirstFileExA,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004940 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D9950 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB41584 VirtualQuery,GetSystemInfo,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 50000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 40000

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: rutserv.exe, 00000009.00000003.1919101620.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006705000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.0000000006705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: rfusclient.exe, 00000004.00000002.1733215838.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_11004DE0 rdtsc

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB43050 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB50C00 GetProcessHeap,

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB43050 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB475B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB43234 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB423F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DC073 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E5AA7 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D4D22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12032EF0 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120324E5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203558C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall

Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB2DBDC cpuid

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: GetLocaleInfoW,GetNumberFormatW,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: GetLocaleInfoA,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: GetLocaleInfoA,

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB40634 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_110E0E32 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB24EC0 GetVersionExW,

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: rutserv.exe, 00000005.00000000.1736259820.0000000000D41000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Remote Access Functionality

Detected Remote Utilities RAT

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters notification	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters Security	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters General	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters CallbackSettings	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters FUSClientPath	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters InternetId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters Certificates	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters CalendarRecordSettings	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068160 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E3A0 DSO_bind_var,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E420 DSO_bind_func,ERR_put_error,ERR_put_error,ERR_put_error,
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9870 NCONF_get_string,ERR_clear_error,DSO_load,DSO_bind_func,DSO_bind_func,DSO_free,ERR_put_error,ERR_add_error_data,

Source: Yara match	File source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	3 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	3 Windows Service	14 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	28%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.flexerasoftware.com0	0%	URL Reputation	safe
http://update.remoteutilities.net/upgrade_beta.ini	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade.ini	0%	Virustotal		Browse
http://update.remoteutilities.net/upgrade.ini	0%	Avira URL Cloud	safe
http://madExcept.comU	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade_beta.ini	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
id.remoteutilities.com	64.20.61.146	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
id72.remoteutilities.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/support/docs/e	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpet	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	rutserv.exe, 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/support/docs/s0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://madExcept.comU	rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/support/docs/o0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/rt/docs/r	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpet	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	rfusclient.exe, 00000004.00000003.1728446387.00000000033EC000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000004.00000000.1714769466.0000000000E4E000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.000000000122A000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000002.2909594242.0000000002675000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.remoteutilities.com/support/docs/0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpB	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/internet-id/	rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php...	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/index.php?src=app?src=app	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/index.php?src=appx.php?src=app0	rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.remoteutilities.net/upgrade.ini	rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/tell-me-more.php1	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php.	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/index.php?src=app	rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/t0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpes.	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/connecting-over-the-internet/	rutserv.exe, 00000009.00000002.2971300777.000000000503E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/rt/docs/	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.remoteutilities.net/upgrade_beta.ini	rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/tell-me-more.phpdo?	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpken	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.flexerasoftware.com0	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/a0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpum	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.105.132.70	unknown	Russian Federation	42031	PLUSTELECOM-ASRU	false
64.20.61.146	id.remoteutilities.com	United States	19318	IS-AS-1US	false
185.70.104.90	unknown	Russian Federation	49335	NCONNECT-ASRU	false
66.23.226.254	unknown	United States	19318	IS-AS-1US	false
101.99.94.54	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1385428
Start date and time:	2024-02-02 09:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe renamed because original name is a hash value
Original Sample Name:	3_.pdf.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/88@2/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 192.229.211.108
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:37:16	API Interceptor	466522x Sleep call for process: rutserv.exe modified
09:37:24	API Interceptor	105497x Sleep call for process: rfusclient.exe modified

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	32359
Entropy (8bit):	5.221077217292647
Encrypted:	false
SSDEEP:	768:fltototxA6rSrBjp1kyUXGiM01HuECIQcQpeQn6mPaUaqBt6M+pG57:YGsBjpKyUXGeHuECIQcQkQ6mPaUaqBtD
MD5:	68206233254021EE853F27ADA734D571
SHA1:	E39BBFE2F243F5DA81FF44D7F3F7F4304635A8D6
SHA-256:	70B973BF6109792A708B02D6EE011540F39C6EE73B4C7E2FBA20B23E9D4D8E7D
SHA-512:	4E6FAD6664F3D6FC8DF295BE51C5D07286EBF591AA849E57C39D781879F7D4C4EC111FB727DA2BABCD2D21B2E9E6ED286D2D08D1C350263E37E6BF0434468E9F
Malicious:	false
Preview:	...@IXOS.@.....@.LBX.@.....@.....@.....@.....@.....@......&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}..Remote Utilities - Host..Exel.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{BFB6CB81-8A2D-41FC-A737-5CF8EB370093}.....@.....@.....@.....@.......@.....@.....@.......@......Remote Utilities - Host......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{3244CDE6-6414-4399-B0D5-424562747210}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{197F692B-7CCA-4D79-85A5-ED04202D08D0}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{E79AC184-AD38-4B26-89D0-75B7CEA19FA2}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{BDFF180E-29DE-4951-A6

C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252
Category:	dropped
Size (bytes):	15975
Entropy (8bit):	4.971311456641861
Encrypted:	false
SSDEEP:	384:Akc9TI9T+FCnjK71n5yqmOxSCH/Cu37gFpBukSVb5R:AkcuoCnjK7Rh5Cu3U/W
MD5:	9B0E600EB09E7A86199F7BA245D1CD2B
SHA1:	E3E52B3E04B08E59AAE74300F7D30C3D0AA27148
SHA-256:	879180116B82210292648709982F405EAE84B05E6F2FF324A6A5CC7CD512D3E7
SHA-512:	DD1622474C48ECF5C95E7585FB30B5279CF45DFC89332531758838B05F73499F536F7CADAF529AA4FA5AE0808E30A455465829DB7D13F2EE2E7D9B7BD12E17E5
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\cocoartf2638.\cocoatextscaling0\cocoaplatform0{\fonttbl\f0\fswiss\fcharset0 ArialMT;\f1\ftech\fcharset77 Symbol;}.{\colortbl;\red255\green255\blue255;\red51\green51\blue51;}.{\\expandedcolortbl;;\csgenericrgb\c20000\c20000\c20000;}.{\\listtable{\list\listtemplateid1\listhybrid{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace360\levelindent0{\\levelmarker \{disc\}}{\leveltext\leveltemplateid1\'01\uc0\u8226 ;}{\levelnumbers;}\fi-360\li720\lin720 }{\listname ;}\listid1}.{\list\listtemplateid2\listhybrid{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace360\levelindent0{\\levelmarker \{disc\}}{\leveltext\leveltemplateid101\'01\uc0\u8226 ;}{\levelnumbers;}\fi-360\li720\lin720 }{\listname ;}\listid2}}.{\*\listoverridetable{\listoverride\listid1\listoverridecount0\ls1}{\listoverride\listid2\listoverridecount0\ls2}}.{\info.{\author Marat}}\margl1440\margr1440\vieww12540\viewh15120\view

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16352
Entropy (8bit):	6.54052527746532
Encrypted:	false
SSDEEP:	192:IxgSABvdm4Yy3EA39QKH5EDZSZuc2+huLdALWwsUJZscF8Bd1LPK6CYHB5K:Ix0FmW3EaHiDZSZwJdLSZsHLPK6jHG
MD5:	73E40D762BA0B67027B8A489E5161821
SHA1:	F4D9B83EC23C6226C20C39F1B996894992707124
SHA-256:	37E3F9B5D5B95A47EB44E72E1E587C553BCAB7981DFF5D108FDE86B702E1A858
SHA-512:	8F9FC3533433AF5B44B1E19B377D184FCA51A95B6289B9D80628998802FB1ACEC488F22FFC563E1CC413DFD8FFEF2E097E882C29029BC29CFA11F9434A8DF002
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......k....@.................................."..x....@...................!...P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2674656
Entropy (8bit):	6.865564996943119
Encrypted:	false
SSDEEP:	49152:dE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeFG:dE8XHX5riUl7wDP6vQ/qpyr0kR5XLWD/
MD5:	D47B1FBDAE6406EC50110A3C59F685F4
SHA1:	B242609CB05CA8F5BFD08306274D10AC6E22E20C
SHA-256:	B03A3AD0C77DD9FD4DE0CB1FF938074ACCFBB8AC413524B1158DFA5014A26CE2
SHA-512:	E2601392D9615138B32F33295CBACF1C54A7DDD04FF4BE70800190CC55F1FD6EE8A8400913E103FC74C0C57D18B1A94B81E9E5EC9AE9182BA03D413B87DD7E0E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L..../.\............................5u............@.......................... )......9)...@.................................<.&.......'.H.............(..!....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111520
Entropy (8bit):	6.491611255996076
Encrypted:	false
SSDEEP:	24576:UqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzz:SQSX0oAtkpf/bfcyTTmoozz
MD5:	829AB21444204D50C64B805FE7897433
SHA1:	8540A93A2376B4B3EA447830775FFA69AB089A63
SHA-256:	2FE3D65C4CB5CB2DBB73AA0C05392230F7B52A7482C80A531B2E4C7DC42C16D9
SHA-512:	E5FF3639B275B6849FF0E974E4A921ED9461B4257684F088E651D32080C07F09394B19FB75E5EAA69C250CFAA682F6E3740CD0BA65F16B0FFBD81F01183FF2A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d........................!.......l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23520
Entropy (8bit):	6.440740836511924
Encrypted:	false
SSDEEP:	384:Bb57Gk7g+iy218DTK9jkrtpgjKMp+fZSZwJdLSZsHLPK6jHvCg:h/218DTVrtsKMsBpPKgP1
MD5:	99B4B661886B0E7B480FEA0847ABD1B0
SHA1:	397EBD9B25DB33B20E5FECA257BDFA69424D8693
SHA-256:	0168F614579F7EFDE386DF3C6F63A3804DBB5EC37ED954859B4CEE3D82065617
SHA-512:	9F150CDA46349401984BA11F3E88FD379A36006CC403AD78DF02A6BFE4D9EC49043A343A49B7349C19D2391ED84D9B27E6BCF374322E76F4EA6E237852A97157
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L..../.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:...!...p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4006368
Entropy (8bit):	6.80959441986422
Encrypted:	false
SSDEEP:	98304:ZbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FA8:5R+lDOt5kgFvVwmr
MD5:	545F1581B2486E834B8FA676A5F7A8EA
SHA1:	2AB6F0B7D1FC4CE98CAE89B0DC04D7972CC67D77
SHA-256:	21E0FEBE30F53D63985ACA992A1BCF2B6853B6B23808BD910C4EE54979B271EE
SHA-512:	1DF88C03CB89845C484767897FA6CAD1C6412B10C67363E597BFC80BD0798F99D2C47A84FAF6A07B721D81CA0F3D0D5A7F3F7BDD2B179819A468F9DDA07F5826
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.......>...@.........................pA:......p:.d.....;...............=..!....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40416
Entropy (8bit):	6.363657503806742
Encrypted:	false
SSDEEP:	384:ZkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQMUQ9LSk3E0gTSsn2TkhI3K0Tz:ZLqokSaddQMUNk3EXSsn2Tk4j3pPKgz
MD5:	65BE96DA02367532D8ED15F1300850CF
SHA1:	A8105BB2B6759450726539831AB646209C3EA51C
SHA-256:	5ABD11523B355CEF76D32DF24D9E82ED148B1A6DC3CA7C2FD7197FFED45D74E3
SHA-512:	F336974A176120AD7453144548CD01CFFF71F91CCE6E146F99F1ACFA488A57CBBDC436DACA54F1FD04254E48BD86C54C90D990A33761BF1C4874621C31C513D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L..../.\.................D...8.......I.......`....@..................................~....@..................................s.......................\|...!...........b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180192
Entropy (8bit):	5.245276621355164
Encrypted:	false
SSDEEP:	1536:zvQtL1VQPsuMC7Wsb5o5/mXOMzZ52NyoGCIfb0wk7UAjKQpmArUaDZqxw+:E/i97Wao5eDaNvGCIj0w+mArBZk
MD5:	1589EAD8B5B00AE5E574FA6F005256C4
SHA1:	894D1EB249155F9383870F754B745321EA924473
SHA-256:	6D4939FD651AF68DB82784425A2B6805F1169376B5CA9C5821E5C8CFB81C549C
SHA-512:	86252A061E102E87933CEFA53F31F1AD459A91AB555D1847F10583D9096542E2912AA7230E90DCFB3ED8EA5E8F2D232AC81C203E943DBF2E690AC8D500EB24AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L..../.\.................\..........8........p....@..........................0............@.................................,5.......`..V................!...........z..8...............................@............0..,............................text....[.......\.................. ..`.rdata..(E...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53728
Entropy (8bit):	6.5571910635788635
Encrypted:	false
SSDEEP:	768:jqfYiEXOtlk4SgVg1pQtfVuTsxxSzELKoZeepPKg3:ZiEXYq2g1pC9uToxkiZ/x1
MD5:	A810FC0F499E254375FB1FA9116E2CCF
SHA1:	CBD73834170A05A8D47846B255E02A2C7778C06A
SHA-256:	966EF76FE3476D530B1B97A6F40947ED14ADA378F13E44ECFE774EDC998CD0B0
SHA-512:	59D0855636E25C0F41A5401184C7CA16082A25FF72CAAD2D2C183E3977FBF60AE50C2E6A9F686681F1F19067225BB68C6FB3AEA808E7E5982C49B08E2095A669
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L..../.\.................v...:......Ez............@.......................................@.....................................x.......@................!..............8...............................@...............\|............................text....u.......v.................. ..`.rdata...!......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772960
Entropy (8bit):	6.917269583439067
Encrypted:	false
SSDEEP:	49152:QuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChReb0:QuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpn
MD5:	E608CE332F016026E3D3B62E606192CA
SHA1:	0A5FB826AC299D4D086AF8BF1391184A15976571
SHA-256:	57AB69CBCB0DA76BD70D897514AEAE6858F52BD391B955D5C3A980A19F1DDE58
SHA-512:	53E4E647D43910D15158EF61445A77F80D72F7A63001C220D8A53853DCF04918B849532305180347A230D70E61992C034C48CEE2DAB8247BEE113FEB5AF1ACAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... .........................................@.........................p.'..:..T.(.......)...............*..!....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2992096
Entropy (8bit):	6.789893578257523
Encrypted:	false
SSDEEP:	49152:kN1BAW/tsUJX4JIHl3LhI2NnmTYH2RXoSrB/KYtvQ/qpyr0kyaTGjEawEP1vsB9u:kN1BaFY3FI29mTYH2JRwovQ/qpyr0ksD
MD5:	45D5F1B29B1B40B232D662DACF07D0DC
SHA1:	822E821E261B385FA7300530AA633A2E0C7D7914
SHA-256:	F224CDCDE4A049C4F471CC2C50E75FB55E4C0A540FEA4AD24A4C57E97DE48780
SHA-512:	1ADBB3D83107DCDE018EC41902FEF7C5E3AF3D6A7BC11AA6C71D23FB23F02ED36E9D6317631523D7B837FD19D934C0DCE73345B5DF0E82C2BE4B0A831C6A8282
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L..../.\..................!...........!......."...@...........................-...........@..........................+.+.....+.......,.@.............-..!....,..C...................................x+.@............."..............................text...g.!.......!................. ..`.rdata..T.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130279
Encrypted:	false
SSDEEP:	3:z8ANyq3jIZc:z8cy2wc
MD5:	610DFCD7FF61B76DAAC9DDC3CDAA64A9
SHA1:	343A63A7E2B0617F30B94E15E236DF7892FE722D
SHA-256:	7BA0ACE1E899C38CB5E8BF303868C0AB4B9890D536009CF21C958B114888DFA3
SHA-512:	D8095398ACC9DE610E42EAB655145BBACB09AE2D460906F9B490E48947EA802795C00CBFA3C674CDCC344D8A64FD63961D2D4A8999E0F0BADAFD3E367FE8B495
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rupdui.dll ..

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36320
Entropy (8bit):	6.363095921735073
Encrypted:	false
SSDEEP:	768:/ek2AuDHuROuyVrGWngM328PAh8bWgs5fLutlfpPKgPH:foebh8bRs5zutJx5
MD5:	DA9CC6631ECEDCF3819332552F1EB449
SHA1:	161B227A23E87E4D7A7F59CF12AB87CB8D5D41A9
SHA-256:	363C85F73AD85F041BBAFB141B8EF1B7BD7A1268DA6B39F96D81582303C9ABE3
SHA-512:	29262D594D4112577F60CAB26698731381FB19BC0AF28BAAF1A2F07951617FE71F8BC7AF30E330F7A936BC3531CF9BCC58B00C0AA86B8C28AB558DA845E62EE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d...O0.\.........." .....V...........P....................................................@..........................................d..W....[..................`....l...!.......... ................................................................................text...GU.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204768
Entropy (8bit):	5.825387232540853
Encrypted:	false
SSDEEP:	3072:pZN5YrUYkIih2FJ5tmN8DNWcpQOw9Tsk1n1WOA6uBgmW:pZNhfxh2FTpWO2T/1WOA6uc
MD5:	75C636087E541A9524752F1DF66AAB99
SHA1:	C33E55AF6F92D48BE994F1999193CCD9F1C586BE
SHA-256:	EA37728ABE1401F32F01C113701EAA447380B65E58934AB0360113CA86CA1FF6
SHA-512:	9A871DF80660DA09F7297D69ECAADAC13F03DDCD298F5300E83C194A394EEC990743FCE5B6B3554BC0123CE96D1F3D5F124344B7E5247D282D540D853BC11C3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d...80.\.........." .................~....................................................`.........................................@H..l....H..........(.......<........!..............................................p............................................text...=........................... ..`.rdata..............................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102880
Entropy (8bit):	6.071756563190581
Encrypted:	false
SSDEEP:	1536:PFqz35CEMCZFwsbn60NhoBGO9otLJx39aHXI0OYWusz+xn:9wJ3MGimnrhoAOkNa3I0OYWtzu
MD5:	D0F22AFD5EAD9FFF432BE5746F2F989A
SHA1:	D83187AAAFD3BE638457E79961E54F22AFAD81F3
SHA-256:	C57FC5CFD1FA1241849AB423B49CE04D2EC361D2972204A2A9D7039D7100A8D7
SHA-512:	F2B0B06FB47775DFA448034953B4E5B97770F384978112FBAA7F1F1EF2EB37875634F963DB2E9515B4678DF63E314FBCE26D1A6A958C3DBC5C57E1CD32593D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...H0.\.........."............................@..........................................`..................................................[..........\|............p...!..............8............................8..p...............P............................text...=........................... ..`.rdata..&g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487904
Entropy (8bit):	6.3408335931113395
Encrypted:	false
SSDEEP:	6144:EgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvm:EglSTPaRxFdLXyJ/ebEEkx0rqJduw
MD5:	CF36C1CFF0210B423921398E8AEF1C59
SHA1:	85F694BAC2B4E2D724542AB518C7BF6C5361AD3E
SHA-256:	45230CA1752B1FD2901708A45E7CC6F1370F65C495D30B08D9F1CE4C8BEAF6FA
SHA-512:	925067AD750F6A01FA0C31DBD876088BB65C36AB8C0889A3A52F0D452154D2BE8284E1077BA1553E06DEAE2181F437E077F13D5FAFD8AD5A3F6C9FC417CB774F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t..........................................@..........................................4..........x....p.......@...(...P...!...........!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892896
Entropy (8bit):	6.044545103599267
Encrypted:	false
SSDEEP:	12288:hpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so7:JZ5F/bYogxJUB9cwtHFMD0
MD5:	D77628FCE2A09AD76889E3300150F99C
SHA1:	2280483371D679437901EDBCDEC0D11F057AF5E8
SHA-256:	9E1BE3FFE0AB8B8D3B6AA964AA9F752E850304A212BCE124C50AB08F1259CC0B
SHA-512:	BB8A28BB61321E5B414E1BC2C9267D38E2676AC1BE8DF27A9A747CB7F7CFE97C1DBFF6C723DC958BE594BE38312172DAF7243B47C25AF2C1D377EA76C423A0A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................G.....@........................................../..{.... .................../...~...!..........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	771040
Entropy (8bit):	5.631799273811714
Encrypted:	false
SSDEEP:	12288:rkozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:dzBEGbL4Np84TQazCSiRC
MD5:	2AC9DA11C87F558D785924C5E814A6C2
SHA1:	6EDF8B0224B9D2F666E2DB4E093703508DABF512
SHA-256:	4CC04BFD8ED79191FAF1520B3ABA80B45E2EEB653D7C48A960CD18A59C04E001
SHA-512:	C4DA961C9C6A3AB586B8FDAFDF8D4C59A48D902E4300925B28E275DF1168E6FC1C2D51E4EB1E07429401090ABB4FD97AC7AC96E78DE50EBAC887B6007C1F4D3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0................!...........................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130279
Encrypted:	false
SSDEEP:	3:z8ANyq3jIZc:z8cy2wc
MD5:	610DFCD7FF61B76DAAC9DDC3CDAA64A9
SHA1:	343A63A7E2B0617F30B94E15E236DF7892FE722D
SHA-256:	7BA0ACE1E899C38CB5E8BF303868C0AB4B9890D536009CF21C958B114888DFA3
SHA-512:	D8095398ACC9DE610E42EAB655145BBACB09AE2D460906F9B490E48947EA802795C00CBFA3C674CDCC344D8A64FD63961D2D4A8999E0F0BADAFD3E367FE8B495
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rupdui.dll ..

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34272
Entropy (8bit):	6.279189104394536
Encrypted:	false
SSDEEP:	384:sPE2+V5RqtDLvnmQ67I+Ud26uiGKjjAVAjXzjrMishb8pL4g2t4Qh5ZSZwJdLSZb:s2gnH6sDGuB3jrRpLr2t4QhvpPKgCv
MD5:	52B7FE7D8EB30DB65D821F513C99532A
SHA1:	2D29A4B71DA3992352AFD2C49E0234C93DD993AC
SHA-256:	49898528597E2423086D53F9639068AF46D060EB2ABDFEEE7D28CE069CF86F91
SHA-512:	7EF81871AF993327792EBFE5920E464120F9088E9E55971ABE04B77FA4E75365B24898954B27972A6A74DA622CD1088094E3952E5939CB844AC9A063DF3BD703
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...L0.\...........!.....F...........D.......`......................................Uz....@..........................U..W....M.......p...............d...!..........................................@...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160224
Entropy (8bit):	6.183469966253267
Encrypted:	false
SSDEEP:	3072:TYmfMb3REEgw5ojOfC0ZV1AxNjwE0cqR4n2AMNR0wmlmo+W+DAeU:Xfso0ZV12Njwhcqy2AMNxwzEA1
MD5:	91EF01D7DFB11B218B67DB346562161F
SHA1:	F27B8A35BA7630C6AA26E21872CA1EE706642D1B
SHA-256:	48BA5C22A72132A140A881A62B20CE778DDB1B6E495BCD23FAAFC43FB01FB3B1
SHA-512:	FE3AC0AF8822780CA36F1BB9A9E1F5E4168E61415E4CCE8CC20F8E402D9E5EA9F53E5B2F0680C65213D81C04A3193BF2D85C0BAF3256009549D01319B18D9247
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....0.\...........!.....L...N.......0.......`.......................................^....@.............................l...............(............P...!......@ ..................................Xz..@............`...............................text....J.......L.................. ..`.rdata..DC...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88032
Entropy (8bit):	6.425120133434353
Encrypted:	false
SSDEEP:	1536:Df1NQO+vd2nRnm4Mxcdn/2hYN7ZOdrkgUzinLnx9oxGcZ:Jo2nRmxcFe5xNUz8D8
MD5:	243C54EF85CA15238782BE036632E0C5
SHA1:	93358BA47E32F9B7513ACD2A27E3F86C9F037497
SHA-256:	00ED874B46999FC5E48F145B9DF3792EA7204FFF3DB28EE035BAF2EFB8DD9902
SHA-512:	C9EE7E75F4BBB5934D1A0344375C68AE8B2A229857E7A3B0D1AED0A7CFFCD074F4D502B7D1B13928E793FE69A6ACC056D3CF98011FABE3B21E513D2E9D943B2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...C0.\.....................n....................@..........................p............@.................................t........@..\|............6...!...P..........8...........................`...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383968
Entropy (8bit):	6.6511922978509315
Encrypted:	false
SSDEEP:	6144:9plBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lAT8:Z0/djgEUhWnJ2UlxqOttoICvPn/318SW
MD5:	49A0A7C3E3F5DF3DDE7121109F1C9C21
SHA1:	716DA115C392CA06379A33079A54722800C13054
SHA-256:	CA38185341294720808A389C34D45FAF2EF7962A7D45AC7696823A6D05B45072
SHA-512:	9BBD8C585E42EC50D6FA9A38BCD39720F7A4F4730A1C8EECC3C5ECBADAFDFD6120D7FCAFA9A319F8D94FC962F537BD0B50EB7CAE614F5116B55D330F7FCE0118
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................].....@....................................x........................!..............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756192
Entropy (8bit):	6.198619685669809
Encrypted:	false
SSDEEP:	12288:llIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxS:lvM36KkyCLW7QCwSGoS
MD5:	D66F58A5DF5AADDD348CB06B9326B84D
SHA1:	56B390BBB29DAEFE3171491D5697986A7D7AA0B3
SHA-256:	30D2605C283885C99E3F97D876989DE9E34380B20CF01D24DFDBE4CB50C92603
SHA-512:	5F0BF8698AE8809AF13D7E1504C1BF50BCDEC5C146A0AFA9F78174448E2D9A61AA83589C7836B452F3F9029FFBAAB8902138791EBFAD0EEB31B687A9EF7716BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p................................K$....@.............................{....3.......p...............h...!...`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771040
Entropy (8bit):	5.630737263013527
Encrypted:	false
SSDEEP:	12288:UkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLz:kGBEGbL4Np84TQazCSiRz
MD5:	41933A3BF1A30E05DC81ACCDA893E2B9
SHA1:	3C99CC28A6DB76000E3A31DC93C76AE18E2CD20D
SHA-256:	9C5CDC7BE14F3D404423EF9A8EA5A3EDC0157AA5F96F428FE7D857CE5F312FA2
SHA-512:	C5101249DB23080D76264505BF2DFCD636D99509E2DAA0CF601D5E997D145BF71721C2CFDB05AE0AFFD64317F7585040B2F7B48467367542C89D0F1F40F41D03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@.............................................................!...........................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53560
Entropy (8bit):	6.504835643855465
Encrypted:	false
SSDEEP:	768:wsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYqSwCpRAMxkE1:wza/pu/TKJ/OMpTryYfwc5x5
MD5:	B2E6147F97DAE696265A089F98CE8106
SHA1:	418F20EC486B7A9368CEFF183E7CEBAE9BA52101
SHA-256:	44917B2C260FEA3A0F4691F6E986C25E31B3F9FF22DCD055526199B4D8A54051
SHA-512:	789DD02281B71FAB54F42B92B5C0C76C0266C40100DBE532AD3EBBF968E8A9E674F0BE57E2FFDB10EB4A6B4FAA15A6A6A92907C020C6CD2990427D890D7F5026
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...q.7`.....................$...................@..........................`......i................................ ..q............P..................8!...@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1389368
Entropy (8bit):	6.858641353727598
Encrypted:	false
SSDEEP:	24576:2NaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1:+lUfzN4jH3PlyjYpOLqd/kP1
MD5:	B0433711581916700978618558131929
SHA1:	6513C7C14F19FA37C73926FC098A9DA678621E04
SHA-256:	26B24DCD9CB7AB8761AE7FB597704F81E2A6EDE6572A247C39A969960DBBA539
SHA-512:	A1D8BCD4B641B5E54A4435A70E19A56ECCE6DC9C7D9B6FC28F7829DE96D139C9CFD10F35F096529F8D33583BEA8FFE1B6C2636F2710D9D01F1A7513F77DB8589
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................d...............................A.......6..x.......0...............8!..........p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10931000
Entropy (8bit):	6.790449999326776
Encrypted:	false
SSDEEP:	196608:mY28xa5k15O2/w9DcmIHsZYk3BL5tksbmd:mY28xZh/xcY6LtbA
MD5:	6AAE165F3B1575DB887A0370CFC80083
SHA1:	18BC72662B4366035932719EF131417AACF9C184
SHA-256:	0C89262A283C80121BA1176345B230D0ADE61CFCF682B92E555A48206FB4074A
SHA-512:	666F1A5C6B0C7A5315D70EB0D75DA6232105E5673B44F6137BE4B10377B8D07C21720D05360CC653F543657478B08EEE1D95DB5FB1CB8D82D5C2A0F2FF68E7C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...,.9e.................z...,&...................@................................7.....@......@...................p..........W.....d...............8!.......D.....................................................8.......Dt...................text............ .................. ..`.itext...X...0...Z...$.............. ..`.data...p<.......>...~..............@....bss....................................idata..W.......X..................@....didata.Dt.......v..................@....edata.......p......................@..@.tls....h................................rdata..]...........................@..@.reloc...D.......F..................@..B.rsrc...d.........................@..@.....................p..............@..@................

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21148984
Entropy (8bit):	6.620129778488873
Encrypted:	false
SSDEEP:	196608:Sd9U0CaHFxbNvfkPrWcrKZPYOrnnGdDoFI0wb6AIALUKyL5w2kEdyMZNAxa:Sd9U0HxxUPzoPGUAIALUKy/L
MD5:	652C2A693B333504A3879460D0AF7224
SHA1:	235BA3847DF3F39AD445B5B912CB2FB5224D9E59
SHA-256:	760E2FD3E57186B597D40B996811768E6C4A28CA54685E029104FCF82F68238D
SHA-512:	A717E916E9D881970694856F79F0E571B95C350F0B771027188DC9B27AB99C193149D4FE0E32CB4638C840340EB1DBD7FBF7458A58985A3E5BE7DA3345CD86C6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...8.9e.................&...jR......>.......@....@...........................O......HC...@......@..............................._......T.9...........B.8!......0...................................................(................................text...`........................... ..`.itext..4........................... ..`.data...$G...@...H...*..............@....bss.... ................................idata..._.......`...r..............@....didata.............................@....edata...............V..............@..@.tls....h................................rdata..]............X..............@..@.reloc..0............Z..............@..B.rsrc...T.9.......9..x..............@..@..............?.......2.............@..@................

C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346424
Entropy (8bit):	6.566551582367787
Encrypted:	false
SSDEEP:	6144:f6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1PiH:f6MNzVgz1LgXCpfoaDqHojjYkARqPL0Z
MD5:	74F9696BE4B46F04A1263C3181405C35
SHA1:	CF66B349BEAA2BC25ED5807763E32018E4304C7B
SHA-256:	D6E8BEE1A9476ED3BE229F4BE81CC1154F1ED425E50E74FD1ABCD76C56EA062C
SHA-512:	F122E00B795476809994733028346D82945566CE4C2BE26444F02E077658CCB1BA0F3FE221CEF37837941054FE4B3B54B3F9A74861F890E56544D1453823FD68
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`...3...3...3...3...3..f3...3..w3...3..q3...3...3i..3..a3...3..p3...3..v3...3..s3...3Rich...3........PE..L...#..]...........!.........l......i5..............................................y...............................@....).....<....0..0............(..8!...@...,..@...............................@...@............................................text...j........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389936
Entropy (8bit):	6.646719638285826
Encrypted:	false
SSDEEP:	6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwck:EI8tiDOzyH9H8Tu6h04fZMZoMPuvf6d
MD5:	C14000F68306F1CF0EC799DF9568AE01
SHA1:	788D8D7A0BA86BA6C7EF4F7AE50CDC65DDB348FF
SHA-256:	53B040341CE80F246C8437A99DF5252A48801E2154EB94DC50AF54A75D8D85AC
SHA-512:	2D4769949832794CE310474F843B696EA8EEB819554ECD72C449981988A6F8FBC5155D84A97D8A4C015348B3DFE6708F88C64B257D4A4D0D4A03DD068DDA4113
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................................................@q.......q..........................0!.......(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641784
Entropy (8bit):	6.688224632605251
Encrypted:	false
SSDEEP:	49152:vSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwW:vSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSg
MD5:	30448DB0AAC5AC16D7AD789011BF8D20
SHA1:	457A43F6D2A0120C138DD9D57BCB64B21F84D9D7
SHA-256:	D781088435617CA1FACF74C1304F82AFCB388813A75C8CB32213541D35B21832
SHA-512:	300E3AE2AC133E2494C449354582AD9BE51731D3E92D161B998DB14262CC08436EEDDB2B73A2F47CB4D1245348055F19E02721638A64A0630F513D4919B359DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*...............................................!......................................(............7..............8!.............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	267064
Entropy (8bit):	6.532234442351241
Encrypted:	false
SSDEEP:	3072:zW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTD:zWSfr7sXSmPDbKPJ6/AsNk+N
MD5:	5E8673834662AC42B8363E19BC719282
SHA1:	BB1C1ED731830A03DB47D232E748DF4E4D196DB9
SHA-256:	A64A113955EC0D89AE6FF357F9BB1063C7DD29FE5610EE516A94AC17B11172C2
SHA-512:	3CF558B2D3CA03AED1EF0CFE36FB7FF3FE7A3AF63A4C3B0CB6CF13C58BAACAE17E5A01BAD743AFFAE8C4F5B9F5425DD4A97755ACA2DED99E70D782F699A9E225
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0......c[......................................4...x.......................8!......./..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374584
Entropy (8bit):	6.776430632714067
Encrypted:	false
SSDEEP:	6144:saoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rt:ooPH0GgEp0gVd1ValsQXsH
MD5:	95D30B282132FB591FD5FDD94E52AF05
SHA1:	EB7ABE2F02C19EE41E4EFC2506337288141D70ED
SHA-256:	E6C04DC8359B2C76F765FCE37EC123D33ACBC5CE93E60022BA88EB7C867AC3F6
SHA-512:	9E4EA23519D243D6D3AE93D2501F05F35AA1CC6264ADB8F180F8A255BD35FB7996E110AC0EC7960FA0B93062BE45EB0C0922D9597E76EE8180781CC5C9A9C792
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b................................................K....@..........................M......@N..d.......0...............8!......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881464
Entropy (8bit):	5.2453925074994965
Encrypted:	false
SSDEEP:	12288:DTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNl:cYF+Eyx2lzujtEIYRc1cQmsGa7ONl
MD5:	A663E7EF3F3CD7A1D4790B4EBF491C27
SHA1:	BFE086E653D0BC8D20ACAE61990BA4FA33F2A1F7
SHA-256:	8B1F95D7C0FDF25A6278347AFDA2F5AC4C86045C7FC530A330BE885D8A87EA68
SHA-512:	E78460C287646F509A50B878A34392546E01803A46C389E942073013A8292E3653713F2B6067842ECCCB09B7CDC13D1D9FFF76065AA61910FC3CEBE6A1C20C47
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................\.....@.........................`...........d....P..p............R..8!...`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Remote Utilities\Logs\rut_log_2024-02.html

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CR line terminators
Category:	dropped
Size (bytes):	5364
Entropy (8bit):	5.485641443773401
Encrypted:	false
SSDEEP:	96:I0xccoJxML6RLidRLildgy99M/0bSOtfh/:IzcWS6pidpiHgyMMVtJ/
MD5:	F2E6FCC4D409479E68C5301C9A696197
SHA1:	48EBE4DB096CB4E318F3D69BEC6672FE13652035
SHA-256:	2A8CC3D804AA9FE8D87A392B4587D360B3DB47D0B88FDE34943AC395D13E803B
SHA-512:	4E818F5503CF118F80EF0DD6AFAB952F016BE24EBE56D34AEE23F56748361573C03472B194E982C32608973A730CCE525A13D0D1885023F213C691E4C7933131
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>Remote Utilities – ... ..</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nod

C:\ProgramData\Remote Utilities\install.log

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	4.961347298932099
Encrypted:	false
SSDEEP:	6:HUc+jLmKRLQUUc+jLdd/ao+Uc+jLhHujHO7eVmUc+jLwmnXjKV+Uc+jLOLGeXkR+:0c+jfCvc+jDSoRc+j9Be7c+jRTmc+j6l
MD5:	57527D70DBA3E2FEB786357C144B5586
SHA1:	AFA68E6C5CC3FFA2E1B0148168C961B124B1FAB3
SHA-256:	85AEC0FB9F246A37363CD4FD1FAED3168DDC09901F700C7A4D1A6B6B3FA7625B
SHA-512:	01787D98D47BE918869D421405C8CFAB7D5AE0F8984E24BF6103614C8D2AC9A8A19468CD2E222EF4E69BBCD5CDE2FEB359113B2435C12C270F6886ED4792CA28
Malicious:	false
Preview:	02-02-2024_09:37:08#T:SilentInstall: installation 70220..02-02-2024_09:37:08#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..02-02-2024_09:37:08#T:SilentInstall: OpenService: service not found_1. OK..02-02-2024_09:37:08#T:SilentInstall: CreateService. OK..02-02-2024_09:37:08#T:SilentInstall: finished (installation) 70220..

C:\ProgramData\Remote Utilities\msi\70220_{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\Exel.msi

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\Exel.msi

Download File

Process:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	true
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\49a7b6.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\49a7b9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIAB6F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACD8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1408583
Entropy (8bit):	4.8128312343081046
Encrypted:	false
SSDEEP:	24576:HMMMMMMSLLLLLLLTMMMMMMSLLLLLLLJMMMMMMSLLLLLLLg:HMMMMMMSLLLLLLLTMMMMMMSLLLLLLLJr
MD5:	C1D50A44D3E5171DAEC6BDBF802AC9A5
SHA1:	0707ACD0DED1024989A8043E344D87E7A96218F8
SHA-256:	26C3BE848122AD72E9AF24FE877761D46AE92E34383704F763B4D3D529446D86
SHA-512:	C08F0A7E8741B7C12604A1C267CEA786C917FBC916748DD52D05D80603C2DEB5F23EAAE202A71E5157466CE54CBCA1BE6798A22BFB79D94FA81D2FE3EF1F313B
Malicious:	false
Preview:	...@IXOS.@.....@.LBX.@.....@.....@.....@.....@.....@......&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}..Remote Utilities - Host..Exel.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{BFB6CB81-8A2D-41FC-A737-5CF8EB370093}.....@.....@.....@.....@.......@.....@.....@.......@......Remote Utilities - Host......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}/.C:\Program Files (x86)\Remote Utilities - Host\.@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{3244CDE6-6414-4399-B0D5-424562747210}...@.......@.....@.....@......&.{197F692B-7CCA-4D79-85A5-ED04202D08D0}...@.......@.....@.....@......&.{E79AC184-AD38-4B26-89D0-75B7CEA19FA2};.C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\.@.......@.....@..

C:\Windows\Installer\SourceHash{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1620403438347329
Encrypted:	false
SSDEEP:	12:JSbX72FjMiliAGiLIlHVRpzh/7777777777777777777777777vDHFwd8mvbLHpc:JEQI53W8qXa8F
MD5:	0A729EC420FB3F9CFEEA56D3C5E02D22
SHA1:	781F706A6827E089154CE5270FC9F2D27C503F35
SHA-256:	D14BFCF752F4EDD77151479A460CCD7F085C2803D594A1325A016FD215E8B9C6
SHA-512:	E2BFD7255B6296B52C95C91917C101A9C7F0C74DA4373FC784B5213B142CF278E9787B7E4418F07302BCEF9785E450F4C745A4313084B70BA856916DDA061262
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71360
Entropy (8bit):	5.493854356833401
Encrypted:	false
SSDEEP:	768:PMAyYdTmPJbgqcnDckJdtwCpKAMxkE0twCRr5AMxkEo:P1U81ckJdtwsoxYtwUdxc
MD5:	C5D9AD25A352AB74B481CB2A0E938E40
SHA1:	400D21EEB68A31136C49C4FE5B3FC042CB278CAB
SHA-256:	885C1CD9C61F93C7284FD1DA853D5C58000419655525413CA469B9D5E806403F
SHA-512:	E919646B606B2C8984D1DD9FF5B6FC4F92930290339263D56487DA8A702EC68551B2950E20EF531B452022F3F9FB61A72F73196826AB3E70BDE5521717666FD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(.......t0...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63168
Entropy (8bit):	5.217205507888401
Encrypted:	false
SSDEEP:	768:0dMAyYdTmPJbgqcnDc/soJCtwChfqAMxkE1twC53AMxkE7:u1U81cLJCtwsgxJtws3xP
MD5:	D0F686C7B7334657E93B8DB349F9540D
SHA1:	F855C4FA5FBBCF79C6246AF94EB0046CE8FDCE45
SHA-256:	8DECE53004FFEE3BA42A820D1EBEA3CA1482299A6B5B80D682D9D8CDE3070B31
SHA-512:	C883A8DCD573DF1757FB3737D93B40AB25F83A3896DAF610C0112AF2FDE79EDEE1EC9B9499DF073F4F9D7FB80CD51A8663C4485C8B0DC426CA339032B1902C15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.................................\.......................................4T..(.......\................F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597963610747478
Encrypted:	false
SSDEEP:	1536:01U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLl:cjcT6uuuutMMMMMMSLLLLLLLeYCk
MD5:	0A46537981B366DA572524EA4F0F834D
SHA1:	55AA01DF1728DEF4F143084839980043DDB536A3
SHA-256:	FA4A8E01B7748A816CDF2CF7D29E2B926EE4200F685DC87B2CFEB3CE4D0AA55D
SHA-512:	D1EA98137B8FC3B9F88500E0CF40792937B6A8C5FC918ED6E20C5304A6E779F4864DDEE70D67E1B5FCDCF1CB63E185E5F6CB66AC08A2993F644D41EFEDA97F40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................Zj......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597721784431409
Encrypted:	false
SSDEEP:	1536:W1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLj:CjcT6uuuutMMMMMMSLLLLLLLeYSa
MD5:	0DFAE3FEC66BC6813B9C75C76DBDF0F4
SHA1:	537352720EB1427EFD8E971C7B1CC4F2A007868F
SHA-256:	3F2B3730D09552BED4B2CF28C1E237313A7BE313F9E330BC77B147F29B96081E
SHA-512:	84BBBAA2A91AB2E6A2D5ACF7D956DCCD24B1ED55F5E1913601EAB2BE5F5BBE8FA59048BCF27A7F731A878990AB6AF644386F2FC41749236F23FE559093B2BDB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................F.......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597627123267687
Encrypted:	false
SSDEEP:	1536:31U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL2:ljcT6uuuutMMMMMMSLLLLLLLeYe
MD5:	13D157111B98791617D98963B653F7FD
SHA1:	062439148EE03C9EFBE24C2E4D801B55F6D76389
SHA-256:	23ACEF13F15429D6F30531224CB1E9C58E64B804351C58A89CE7597CAE1DA6AB
SHA-512:	AC435AC73809178001233E6C8753C5320EE271721E903D1D66FBC65994985A9656CF2A31FD215BC230E5C10F1CAD6B49616E2B6BFEF4FF1213E518E4E8BFE10F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@..................................\......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375172572548565
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpEr4
MD5:	6BC3260469EC902DB1D090931B067D6A
SHA1:	2A20547F710A0AF56CF53F253B12AE6E35522274
SHA-256:	E87E04370D79BC679540D592857C0C34F36876A8698ACBEBB8CBF9FC24C2024E
SHA-512:	F4913C0EA6682CEE3C9E23F8DC263630F16D68517A08C3265F03407CCF08701C3899E658C8BC8A885B755AB7846699AAE7C49CCDE3261AC0D1EC6CB988901502
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	6.642066835146045
Encrypted:	false
SSDEEP:	6:ZOxjUpUGgtzuaUUG5o7IpP/pUG3QItzuanflflcZa3kK6l2cZbNjF:ZPnaUUG5FgIgaNfGZaUycZbNB
MD5:	7C8F509EE8BA0782632512240F655578
SHA1:	D41ED379B131EE745D21B000DF047E1A07C76F88
SHA-256:	56C31A3824DC1B9DB307931E3F4F698D9757C22E2011B7DFB381E5EAC0A12366
SHA-512:	A9D6D4AB73527699B1C03C6215DBE7E06D2DCE0597A1DEF28CF4016B541BDE20CD07DB04A29488C1CB7E634305874734AF9A4BFFEC52C5296B5DC5D9AB68B44C
Malicious:	false
Preview:	0..6....../0..+..+.....0......0...0........H.....6A..cib).K...20240201184200Z0s0q0I0...+..........G+~..w.#.....W.....H.....6A..cib).K......@....QC.Y..@)....20240201184200Z....20240208184200Z0....H.=....i.0f.1..J(.\.x....5...2z.....LY.i;Bn....;r..X..4...1...5...<]VZ..[..?:4O.._..I...'....X.....xk...2...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	6.5546319534749
Encrypted:	false
SSDEEP:	6:MBN7ULL7ujQQW+G5o7/MqexL7hf4c+ouzQVtqpmwdFiOfUOELX6eqSJZ:MbY+WX5nrxaStqowd7fUOEj6HgZ
MD5:	888564A0B6D055C179A5CA8137F69617
SHA1:	6A31E95C20B58030865F3CA6D1E8CED3794C259F
SHA-256:	5A4A8BEF73E85D46EC53B81F57BA964FD755D101CF7AE7B60F0EB0451B6DE64D
SHA-512:	D7161FA3675131C1359674CE5CEE688FCF96C7129D5A7DE1BE5C08CCD4358F3D8D404D2DF9656E6C2492115257D664D4C7DE787F7B9988C274CCD009DBF80468
Malicious:	false
Preview:	0..5.......0....+.....0......0...0......._.6.....'..."...8w...20240202051846Z0s0q0I0...+..........[.x.A.<.q)nj.L.._..._.6.....'..."...8w.....G..jZ.n#.A~......20240202050302Z....20240209040302Z0...*.H.=....h.0e.0.}.H.......hw^Cb..'.x.).2.^..-~1p0a.q..'.2.1..OoEb.p1.$7<'.....-}........V]e%....3s.p1d

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	404
Entropy (8bit):	3.913938006640074
Encrypted:	false
SSDEEP:	12:tcNldkEX66sMNmxMiv8sFpT6er+iTw73br:eAEXbsOmxxvbLFTkbr
MD5:	E27E17654028F5B828483EAD36078AD0
SHA1:	4B7D6AE60A07C14BF50B715D0DBC9B5FDE4C03F3
SHA-256:	2F0A81F46DBE0C6B8FD86D1034000E88A308FFB01CDD299048B9421522EAA070
SHA-512:	9B775406662679633438912C80BB2C0BD0E0717B87AE5D9AF37CD6D88000F3E22B8EE2426D59A0838E424D2D84D0087D2B83AE003B58297C31CC74BC0D1F3389
Malicious:	false
Preview:	p...... .... .....g.U..(.................0W>U.......Z.......................Z.. .........9a.U.. ...............:...h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.r.j.r.y.d.R.y.t.%.2.B.A.p.F.3.G.S.P.y.p.f.H.B.x.R.5.X.t.Q.Q.U.s.9.t.I.p.P.m.h.x.d.i.u.N.k.H.M.E.W.N.p.Y.i.m.8.S.8.Y.C.E.A.%.2.B.4.p.0.C.5.F.Y.0.D.U.U.O.8.W.d.n.w.Q.C.k.%.3.D...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	408
Entropy (8bit):	3.9247957560796167
Encrypted:	false
SSDEEP:	6:kKe38qwaRNfOAUMivhClroFH18WilzmlwyiilHDuel8DtQHl+w4lWqlk77ANn:S8faLmxMiv8sFarlyFiiMe+4l+w4PlZ
MD5:	57DA74F59030AED7A30414D6DD925FBB
SHA1:	39FB0C31C8BF2A032F3D788402B33F4C0E363964
SHA-256:	78D399CA8C184B2F7017C8FEAF5B44D237C4379F7CE95A0A013C707C9501614B
SHA-512:	743F7DEE3E86D585EBCB844F8CA099CB5B2CBC9218F0F842069F50639FAA4D666351314D80051F3F2BCE1F746B12EAD15F7A6FFA1F812E6331AB302F37908F8F
Malicious:	false
Preview:	p...... ....$...C.T.U..(....................U....2..[....................2..[.. .........(..U.. ...............9...h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.E.6.7.N.b.q.3.j.f.Q.Q.g.8.y.X.E.p.b.m.q.L.T.N.n.7.X.w.Q.U.m.1.%.2.B.w.N.r.q.d.B.q.4.Z.J.7.3.A.o.C.L.A.i.4.s.4.d.%.2.B.0.C.E.A.7.z.K.k.e.s.D.W.p.a.7.2.4.j.j.E.F.%.2.B.2.x.0.%.3.D...

C:\Windows\Temp\~DF10BD94535F44088B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF43AE85119F93081A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06887906536849638
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOwd6SumvbfzYsEoVky6l0t/:2F0i8n0itFzDHFwd8mvbLK01
MD5:	BE571F185F10B61BEC870EE494C2DB99
SHA1:	F2C1BE92CDA3689AE4B7C426715C8FA1C31A31CA
SHA-256:	F6BF0799FD664C0732F91B052E213BDBB42BA5AC71D0F846739E9E85B21A59D2
SHA-512:	0D8425263AC7F1B7EF53A3CDB2019135A651BDA8283CE5568A8EC0C8B8ED88ACAFE2A6F00ACD0FD92035D1A0EE9EC2DF04E21B76ADB79CF790883B55AE88892F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF46A59DA49B45DF44.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF529C0FE4C5A9CE4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF70B43A60818B563C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8E23FC32B87CAA71.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9FE2B93D9F6F7365.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB588C3675999CB76.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCE78CABB386C66F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD5F4580B380072C8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDE25689DD43B2CB0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.26499363023775985
Encrypted:	false
SSDEEP:	48:QtwXSB29odTfdTuOdThRXdTpkdTpdTKdTI9mSKdTfdTuOdThRXdTpkdTpdTKdTtR:w+qLJnBy/ifXJnBy/itbV
MD5:	4B10A259B2226A26CD98E062FB70F4D6
SHA1:	C6D44E56DEEAD4F3ED0F2AE9D656E88A8A2B258A
SHA-256:	C15AC826D08AB6FC2DDA39716E318A15F291FE8C226AC339B0F56AE784A30407
SHA-512:	63E623E51AC09C3BB7A22AA787C13A06006DAB60CE25020FBDFD4FBEDF808FE82FC555C244246182233E39D091B76C0C379EC3A25C87DFAD4A35FDC5498D344B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE4BF60F9C7AF91F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99798080331911
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
File size:	20'949'417 bytes
MD5:	075d6c122274cb9226521d3cd298f2f2
SHA1:	6f54d70f39fa28596ef90bfcb0c14278b016db1b
SHA256:	92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573
SHA512:	c89f25e451ae095635bee4df25cbf7bb8431d87017ae65898471b346ee3b2a8694b5a45aa00e4dc54881905643c62843216d402e10faadd195e10922a29573be
SSDEEP:	393216:9Vz6+gdQzi/Ew1x1vXYQBEPDdasNaAzEFuEaP3CxMk50pRZfQCy0lifWA5J8EOx:LHSvI+EPDdXNaHaP4Mk50hfh/ieA5nOx
TLSH:	14273306D79D18FCC8A9E67D985B4C47E633784D2211A48F176949A22F83334ED3F72A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0e0f7834fc39070c

Static PE Info

General

Entrypoint:	0x140032dc0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6579B995 [Wed Dec 13 14:03:01 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F11E0BCA2E8h
dec eax
add esp, 28h
jmp 00007F11E0BC9C7Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F11E0BC9103h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F11E0BC9E13h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F11E0BCBE27h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F11E0BB8693h
dec eax
lea edx, dword ptr [00025887h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F11E0BCAEE2h
int3
jmp 00007F11E0BD10C4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597c0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597f4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1e324	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588dc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4664e	0x46800	cb5fa3169f581ba82faed363ff4f6e49	False	0.5365483710106383	data	6.468535106678591	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128e4	0x12a00	919da1ea112d11a732dbc754aee3741b	False	0.44967753775167785	data	5.272430005055125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	17e6aee7483d05299c67ef1c20548699	False	0.28260216346153844	data	3.2575802848760493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	bb12e72c2a1957150354ef39796c9470	False	0.485625	data	5.507547185354104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	ced4b34f6105bed5c533724cbd855e33	False	0.2568359375	data	3.0248828943464656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	c67570d55af77c6d3a435fe95a2589ac	False	0.40625	data	3.3215020267482327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1e324	0x1e400	89bca75165439faf93b747f75742c27d	False	0.938646048553719	data	7.896782666673534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70524	0x13154	PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced	0.9947162376541631
RT_ICON	0x83678	0x858e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9985668324071366
RT_DIALOG	0x8bc08	0x2ba	data	0.5286532951289399
RT_DIALOG	0x8bec4	0x13a	data	0.6560509554140127
RT_DIALOG	0x8c000	0xf2	data	0.71900826446281
RT_DIALOG	0x8c0f4	0x14a	data	0.6
RT_DIALOG	0x8c240	0x314	data	0.47588832487309646
RT_DIALOG	0x8c554	0x24a	data	0.6279863481228669
RT_STRING	0x8c7a0	0x1fc	data	0.421259842519685
RT_STRING	0x8c99c	0x246	data	0.41924398625429554
RT_STRING	0x8cbe4	0x1a6	data	0.514218009478673
RT_STRING	0x8cd8c	0xdc	data	0.65
RT_STRING	0x8ce68	0x470	data	0.3873239436619718
RT_STRING	0x8d2d8	0x164	data	0.5056179775280899
RT_STRING	0x8d43c	0x110	data	0.5772058823529411
RT_STRING	0x8d54c	0x158	data	0.4563953488372093
RT_STRING	0x8d6a4	0xe8	data	0.5948275862068966
RT_STRING	0x8d78c	0x1c6	data	0.5242290748898678
RT_STRING	0x8d954	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x8dbbc	0x14	data	1.05
RT_MANIFEST	0x8dbd0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 09:37:22.025059938 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:22.028461933 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.041404009 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.042712927 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.042725086 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:22.051462889 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:22.247539043 CET	5651	49735	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.247647047 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.260546923 CET	465	49736	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.260616064 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.263031006 CET	80	49737	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.263729095 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.027426004 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:23.027559042 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:23.121231079 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.121229887 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.230521917 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:23.230535984 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.714910984 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.715123892 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.933636904 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105581999 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105581045 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105592012 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:25.105974913 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:25.230550051 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:25.418035030 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:27.368830919 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.489749908 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:27.489840984 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.490696907 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.490799904 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.611716986 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:27.683662891 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:27.699285030 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:28.152405977 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:29.105572939 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:29.105745077 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:29.230571985 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:32.840043068 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:32.886811972 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:33.621156931 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:35.988476992 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:35.988694906 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:35.999866962 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.018121958 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:36.114202023 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.114248037 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.996181965 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.997667074 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:37.011818886 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.027415991 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:37.121166945 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.121167898 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.532773972 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.533879995 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.534821033 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.621692896 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:37.621757030 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:37.753740072 CET	5651	49748	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.753849030 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.755201101 CET	465	49750	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.755371094 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.755496979 CET	80	49749	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.755561113 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418041945 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418060064 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418364048 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949394941 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949395895 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949398041 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.996162891 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:38.996314049 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:39.011812925 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:39.043061972 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:39.121176958 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:39.136789083 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:40.261966944 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:40.261971951 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:40.277654886 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.871217966 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.873662949 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.933794022 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.996592999 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:42.997653008 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:43.027424097 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.043051958 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:43.121186972 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.136895895 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:43.136895895 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.246273041 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:43.796216965 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.875823975 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:44.558669090 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:44.796236038 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:44.886828899 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:46.063117981 CET	49753	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:46.076226950 CET	49754	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.173964024 CET	49755	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.191998959 CET	49756	80	192.168.2.4	77.105.132.70

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 09:37:27.247483015 CET	65129	53	192.168.2.4	1.1.1.1
Feb 2, 2024 09:37:27.366250038 CET	53	65129	1.1.1.1	192.168.2.4
Feb 2, 2024 09:38:26.122497082 CET	50422	53	192.168.2.4	1.1.1.1
Feb 2, 2024 09:38:26.240483046 CET	53	50422	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 2, 2024 09:37:27.247483015 CET	192.168.2.4	1.1.1.1	0x5fc8	Standard query (0)	id72.remoteutilities.com	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:38:26.122497082 CET	192.168.2.4	1.1.1.1	0x5fe1	Standard query (0)	id72.remoteutilities.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 2, 2024 09:37:17.167222023 CET	1.1.1.1	192.168.2.4	0x989a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:37:17.167222023 CET	1.1.1.1	192.168.2.4	0x989a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:37:27.366250038 CET	1.1.1.1	192.168.2.4	0x5fc8	No error (0)	id72.remoteutilities.com	id.remoteutilities.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:37:27.366250038 CET	1.1.1.1	192.168.2.4	0x5fc8	No error (0)	id.remoteutilities.com		64.20.61.146	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:38:26.240483046 CET	1.1.1.1	192.168.2.4	0x5fe1	No error (0)	id72.remoteutilities.com	id.remoteutilities.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:38:26.240483046 CET	1.1.1.1	192.168.2.4	0x5fe1	No error (0)	id.remoteutilities.com		64.20.61.146	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:36:56
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Imagebase:	0x7ff6cdb10000
File size:	20'949'417 bytes
MD5 hash:	075D6C122274CB9226521D3CD298F2F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: msiexec.exePID: 7416, Parent PID: 7316

General

Target ID:	1
Start time:	09:36:58
Start date:	02/02/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Imagebase:	0x7ff6043c0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: msiexec.exePID: 7448, Parent PID: 620

General

Target ID:	2
Start time:	09:36:58
Start date:	02/02/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6043c0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: msiexec.exePID: 7528, Parent PID: 7448

General

Target ID:	3
Start time:	09:36:59
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9
Imagebase:	0xf30000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: rfusclient.exePID: 7600, Parent PID: 7448

General

Target ID:	4
Start time:	09:37:03
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Analysis Process: rutserv.exePID: 7640, Parent PID: 7448

General

Target ID:	5
Start time:	09:37:05
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Analysis Process: rutserv.exePID: 7676, Parent PID: 7448

General

Target ID:	6
Start time:	09:37:09
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Analysis Process: rutserv.exePID: 7772, Parent PID: 7448

General

Target ID:	8
Start time:	09:37:14
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Imagebase:	0x7ff6ec4b0000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Analysis Process: rutserv.exePID: 7876, Parent PID: 620

General

Target ID:	9
Start time:	09:37:15
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Analysis Process: rutserv.exePID: 8008, Parent PID: 7876

General

Target ID:	10
Start time:	09:37:20
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Analysis Process: rfusclient.exePID: 8048, Parent PID: 7876

General

Target ID:	11
Start time:	09:37:21
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Analysis Process: rfusclient.exePID: 8068, Parent PID: 7876

General

Target ID:	12
Start time:	09:37:21
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Analysis Process: rfusclient.exePID: 5016, Parent PID: 8048

General

Target ID:	15
Start time:	09:37:29
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\49a7b8.rbs

C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll

Windows Analysis Report
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre