Technical Information
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe"'
- 'RManService' "%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe"
- 'RManService' %ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe
- %TEMP%\7zipsfx.000\host.msi
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\ruppm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\vpdagent_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\srvinst_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui2.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\progress.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\fwproc_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.hlp
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup_s.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\uninstall.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\install.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.ini
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2659c1a560ab92c9c29d4b2b25815ae8
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2659c1a560ab92c9c29d4b2b25815ae8
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\da3b6e45325d5fff28cf6bad6065c907_6d5b8e0d46046fc4c98a958d41a4cfb6
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\da3b6e45325d5fff28cf6bad6065c907_6d5b8e0d46046fc4c98a958d41a4cfb6
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
- %ProgramFiles(x86)%\remote utilities - host\logs\rms_log_2022-09.html
- %TEMP%\killself.bat
- %ALLUSERSPROFILE%\remote utilities\msi\68001_{e945283b-758c-4a40-b851-1066d0e49ea8}\host.msi
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\install.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\arpproducticon.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.hlp
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup_s.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\uninstall.cmd
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\ruppm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\vpdagent.exe
- %ProgramFiles(x86)%\remote utilities - host\turkish.lg
- %ProgramFiles(x86)%\remote utilities - host\hebrew.lg
- %ProgramFiles(x86)%\remote utilities - host\spanish.lg
- %ProgramFiles(x86)%\remote utilities - host\eula.rtf
- %ProgramFiles(x86)%\remote utilities - host\ripcserver.dll
- %ProgramFiles(x86)%\remote utilities - host\rwln.dll
- %ProgramFiles(x86)%\remote utilities - host\english.lg
- %ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
- %ProgramFiles(x86)%\remote utilities - host\japanese.lg
- %ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\drvinstaller64.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.cat
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.inf
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.sys
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\drvinstaller32.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.cat
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.inf
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.sys
- %TEMP%\7zipsfx.000\installer.exe
- %ProgramFiles(x86)%\remote utilities - host\rutserv.exe
- %ProgramFiles(x86)%\remote utilities - host\french.lg
- %ProgramFiles(x86)%\remote utilities - host\polish.lg
- %ProgramFiles(x86)%\remote utilities - host\german.lg
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\srvinst.exe
- %ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui2.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\progress.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\fwproc.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.ini
- %ProgramFiles(x86)%\remote utilities - host\portuguese.lg
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmmux.dll
- %ProgramFiles(x86)%\remote utilities - host\chinese simplified.lg
- %ProgramFiles(x86)%\remote utilities - host\arabic.lg
- %ProgramFiles(x86)%\remote utilities - host\danish.lg
- %ProgramFiles(x86)%\remote utilities - host\swedish.lg
- %ProgramFiles(x86)%\remote utilities - host\norwegian.lg
- %ProgramFiles(x86)%\remote utilities - host\korean.lg
- %ProgramFiles(x86)%\remote utilities - host\italian.lg
- %ProgramFiles(x86)%\remote utilities - host\dutch.lg
- %ProgramFiles(x86)%\remote utilities - host\czech.lg
- %ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
- %ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\0270780f846f08befe0dd8112d932fef
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\0270780f846f08befe0dd8112d932fef
- %TEMP%\7zipsfx.000\host.msi
- %TEMP%\7zipsfx.000\installer.exe
- 'microsoft.com':80
- 'se####.#emoteutilities.com':80
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://se####.#emoteutilities.com/utils/inet_id_notify.php?te####
- DNS ASK microsoft.com
- DNS ASK se####.#emoteutilities.com
- DNS ASK cl###.##rensic-security.com
- '%TEMP%\7zipsfx.000\installer.exe' /rsetup
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\7ZipSfx.000\host.msi"
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /firewall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray
- '%TEMP%\7zipsfx.000\installer.exe' /rsetup' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\7ZipSfx.000\host.msi" /qn
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\killself.bat