PUP.RemoteAdmin

By CagedTech in Potentially Unwanted Programs

Published: November 28, 2019

Last updated: October 10, 2026

Threat Scorecard

Popularity Rank:	1,703
Threat Level:	10 % (Normal)
Infected Computers:	38,928

First Seen:	August 9, 2016
Last Seen:	October 9, 2026
OS(es) Affected:	Windows

The detection of PUP.RemoteAdmin on your system indicates the presence of a potentially unwanted program (PUP) that could compromise your computer's security and privacy. It is essential to understand the nature of this threat and take immediate action to remove it. PUPs are software applications that may not be malicious in the classical sense but can still cause significant inconvenience and risk to your digital security.

What Is PUP.RemoteAdmin?

PUP.RemoteAdmin is categorized as a potentially unwanted program, which means it is not necessarily malware but can exhibit behaviors that are unwanted or undesirable. These programs often find their way onto computers through bundled software downloads, where they are included alongside other applications without the user's full knowledge or consent. Once installed, PUPs can perform a variety of actions, from displaying unwanted advertisements to collecting user data without permission.

How PUP.RemoteAdmin Operates

The operation of PUP.RemoteAdmin, like other PUPs, typically involves modifying system settings, registry entries, and possibly installing additional software components. These modifications can lead to changes in your browsing experience, such as redirects to unwanted websites, the display of pop-up advertisements, and alterations to your default search engine or homepage. Moreover, PUPs can also be used as vectors for more malicious software, making their removal crucial for maintaining system security.

Symptoms of Infection

Symptoms that your computer might be infected with PUP.RemoteAdmin include, but are not limited to, an increase in unwanted pop-ups and advertisements during browsing, unexpected changes to your browser's settings, and overall system slowdown. You might also notice unfamiliar programs or toolbars installed on your computer. These symptoms indicate that your system has been compromised and that you should take steps to identify and remove the offending program.

Increased appearance of pop-ups and advertisements
Unwanted changes to browser settings, such as default search engine or homepage
Presence of unfamiliar programs or toolbars
System performance issues, such as slowdowns or freezes

How to Remove PUP.RemoteAdmin

Boot your computer into Safe Mode with Networking to prevent the PUP from loading and to allow for internet access to download removal tools.
Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove PUP.RemoteAdmin and any associated components.
Manually uninstall any suspicious programs that were installed around the time the PUP was detected. This can be done through the Control Panel or Settings app, depending on your operating system.
Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by the PUP, such as altered homepages or search engines.
Reboot your computer and perform another scan with your anti-malware tool to ensure that all components of PUP.RemoteAdmin have been successfully removed.

Conclusion

Removing PUP.RemoteAdmin from your system is crucial to restore your computer's security and performance. By following the steps outlined above, you can effectively eliminate this potentially unwanted program and prevent future infections by being cautious with software downloads and regularly scanning your system for malware. Remember, vigilance and proactive measures are key to maintaining a secure digital environment.

SpyHunter Detects & Remove PUP.RemoteAdmin

File System Details

PUP.RemoteAdmin may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	NETWork.exe	f36175806e9d0b21d95d36697d4017d9	32
Name: NETWork.exe MD5: f36175806e9d0b21d95d36697d4017d9 Size: 3.21 MB (3217616 bytes) Detections: 32 Type: Executable File Path: %PROGRAMFILES%\install Group: Malware file Last Updated: October 28, 2017
2.	rutserv.exe	4f40ef14a8143151764c3eb6c972398b	9
Name: rutserv.exe MD5: 4f40ef14a8143151764c3eb6c972398b Size: 9.29 MB (9292616 bytes) Detections: 9 Type: Executable File Path: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe Group: Malware file Last Updated: December 11, 2022
3.	agent.exe	e0f4afe374d75608d604fbf108eac64f	5
Name: agent.exe MD5: e0f4afe374d75608d604fbf108eac64f Size: 3.29 MB (3299328 bytes) Detections: 5 Type: Executable File Path: C:\opt\jboss-4.0.3SP1\bin Group: Malware file Last Updated: June 15, 2023
4.	YP.exe	5d52ceb951384666ffb7a0b7e9b034fc	4
Name: YP.exe MD5: 5d52ceb951384666ffb7a0b7e9b034fc Size: 1.91 MB (1919488 bytes) Detections: 4 Type: Executable File Path: %SYSTEMDRIVE%\Users\<username>\AppData\Roaming\YP.exe Group: Malware file Last Updated: June 26, 2020
5.	file.exe	77f6d6693870fd19fc922d0c3a9b5b9b	0
Name: file.exe MD5: 77f6d6693870fd19fc922d0c3a9b5b9b Size: 4.26 MB (4263939 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: September 14, 2017
6.	r_server.exe	24fc6bf84e755691ad9a9c033378bbf5	0
Name: r_server.exe MD5: 24fc6bf84e755691ad9a9c033378bbf5 Size: 753.66 KB (753664 bytes) Detections: 0 Type: Executable File Group: Malware file
7.	5961315	523057fbbe6c89336b9cb2b1c1b78d26	0
Name: 5961315 MD5: 523057fbbe6c89336b9cb2b1c1b78d26 Size: 5.96 MB (5961315 bytes) Detections: 0 Group: Malware file

More files

Registry Details

PUP.RemoteAdmin may create the following registry entry or registry entries:

Regexp file mask

%HOMEDRIVE%\Log\rfusclient.exe

%HOMEDRIVE%\rfusclient.exe

%HOMEDRIVE%\rutserv.exe

%PROGRAMFILES%\Java\rfusclient.exe

%PROGRAMFILES%\Java\rutserv.exe

%PROGRAMFILES%\Microsoft Games\rfusclient.exe

%PROGRAMFILES%\rtsd\rfusclient.exe

%PROGRAMFILES%\rtsd\rutserv.exe

%PROGRAMFILES%\System\rfusclient.exe

%PROGRAMFILES%\System\rutserv.exe

%PROGRAMFILES(x86)%\Java\rfusclient.exe

%PROGRAMFILES(x86)%\Java\rutserv.exe

%PROGRAMFILES(x86)%\System\rfusclient.exe

%PROGRAMFILES(x86)%\System\rutserv.exe

Directories

PUP.RemoteAdmin may create the following directory or directories:

%ALLUSERSPROFILE%\CardWindows

%ALLUSERSPROFILE%\WindowsVolume

%APPDATA%\RMS-Agent

%Homedrive%\Remote Manipulator System

%PROGRAMFILES%\Remote Manipulator System - Host

%PROGRAMFILES%\Remote Manipulator System - Server

%PROGRAMFILES%\Remote Manipulator System - Viewer

%PROGRAMFILES%\Remote Utilities - Host

%PROGRAMFILES%\Remote Utilities - Server

%PROGRAMFILES%\Server

%PROGRAMFILES(x86)%\Remote Manipulator System - Host

%PROGRAMFILES(x86)%\Remote Manipulator System - Server

%PROGRAMFILES(x86)%\Remote Manipulator System - Viewer

%PROGRAMFILES(x86)%\Remote Utilities - Host

%PROGRAMFILES(x86)%\Remote Utilities - Server

%PROGRAMFILES(x86)%\Server

%Windir%\ehome\ASCON

Analysis Report

General information

Family Name:	PUP.RemoteAdmin
Signature status:	No Signature

Known Samples

MD5: 8b82b0cb9c1515ea617abfae5f75a40b

SHA1: f3e1677f6405e9be96efbbc767809ff77e41d62c

SHA256: 3806A20239ECA00B8D8EB7ACA1C6BD109BCCBB8AEBD83C6EB1545D5DE62A57A7

File Size: 6.66 MB, 6663432 bytes

MD5: 040fbad8e414e9f83b1049e2d6d19660

SHA1: fca4ff4dcd14c7fc67271104839ddf5286fb4c1b

SHA256: A9BDF8AA304FA511AF4BD702E9A1E06487E0191061BE47AF47340CFEFDB09E80

File Size: 3.28 MB, 3282920 bytes

MD5: 94d70ffe5cbc3c34b9e33c1540d6e7ec

SHA1: e1c33ab4ca2664940aac5453e8649f023220ee95

SHA256: 3D5112C10EE98939B32542233C8D6C35FA00C60F5C19CE043B8F8990E5983727

File Size: 57.02 KB, 57024 bytes

MD5: 5a9453bee75456e5e6befae40d93b0c5

SHA1: b3ed58c889ee7fe36a7e53cc70da690e9c84801e

SHA256: 0CB065119B97A7CA77642E13F5794B9BABBA6C3D2B526868A0C93E49BC457099

File Size: 65.54 KB, 65536 bytes

MD5: 92892b7bc7b4270ff9499f442fa4f99e

SHA1: 3bcb725d5fa27e574a74eb269830805ee39960ea

SHA256: 08081F677D5E23E8054FCB14853AB7C949588C2201F5B6DF99B264B678AA95B4

File Size: 1.09 MB, 1093260 bytes

MD5: 4015ddd77c2f5e4220c0afd3d182a849

SHA1: 45bcea822de42b60bf5398fd2b3835a1b9dce7f5

SHA256: 883190C134A8D41DB91F88271F30734F138E479EF36B3C50432ECFFA07EE1F46

File Size: 57.34 KB, 57344 bytes

MD5: ee3de36c062c5311f19bb816ce134f08

SHA1: 44db6ee669ef4536421129a5aca1da6bdcf1e9b5

SHA256: 5705DE7AAEDEFC6830866F2ED0433E589C1D9F2230678BC18942481054B4DA7C

File Size: 321.14 KB, 321144 bytes

MD5: a20c429550987040a5bb11ef07cdcc54

SHA1: 3e05224ea4090da2d109472ec0631003611c3bfd

SHA256: 9235E28A55722D8DDE2FEE5764487FD4BD1B2B7C7327FC56B221ECCDD03BAC62

File Size: 947.71 KB, 947712 bytes

MD5: 8b6686d16805880c582130ca3fbf0be0

SHA1: 847903c75bfa0c61df2e950550b7d301e2907f87

SHA256: 93CBF88A4A8E84C0C7B0A9250CE424987BBAE55BFC06B59DE78D25A6481580BC

File Size: 2.94 MB, 2940640 bytes

MD5: afc24ceb743fb55f9ae4518e05eeea22

SHA1: e7d9f51b8baf2e697e3ad9bedc5bbbcf62873ea1

SHA256: 8E68824823D78CC7615A567FCF6449F62D4CF98C10DA02C69BA27A2E48C65CC6

File Size: 1.38 MB, 1377792 bytes

MD5: 34944acd0923b660220f9c7e6b769f5e

SHA1: ba39e0469aedfc9acd2b80a76d6c957a9dab19c9

SHA256: D01B17B5B06C1D225251EB3F655FEF4949E22AE6C02C3BC1D74213A9F3195A3C

File Size: 2.51 MB, 2507480 bytes

MD5: dae358ff83b01740f72a9a5b6c340c30

SHA1: 182698d9a922a7240e54bd03ae8e83f3a535a83f

SHA256: C097D856C11AE9D60D93B4EC7990156F14D181F1080EAF192C073746AC2E5DFC

File Size: 325.75 KB, 325752 bytes

MD5: 3c51dbad937bd1dd7d3d642b5ada52bd

SHA1: d9fd1fe9c380c6d136a7be6c1bc08bd37caffd99

SHA256: D205CC374641F1ED4F647F792E26B62E7DF8C3F5745E50F3652138F7B8373DE8

File Size: 325.75 KB, 325752 bytes

MD5: ee9494ee88213b4af38c7d7bd4d5ca4b

SHA1: a9c7448b407bf51255c1a0dad1eb5d3a9f2db62f

SHA256: 3E5E6F748D2198586CA8C6465B78D3B0A8722B008386974BAABD518CE4340285

File Size: 2.51 MB, 2507480 bytes

MD5: b0dfa01dc67a1da187e0048ee26fb7ec

SHA1: 65370a113992a5c9b239c6ddcbfdf56208461723

SHA256: 6C98C79224BCD76254E74860B58C7A06F54577FDB6945B014E7C742D9CA8DEF3

File Size: 931.93 KB, 931928 bytes

MD5: b3e563677cdeb04282a67983183dd939

SHA1: b5203c8200531683ef221a87baf67ffd69e037e1

SHA256: 5A70A053A29F4C85A12F0F47E32279B8C4F54F12F32751FE4BEDDA7C3217433F

File Size: 2.51 MB, 2507480 bytes

MD5: 3cb3867229dbc368e2fa17e298e99a0e

SHA1: 23e3f97a8b8568d9fba1d4b7d557cdd0ed21031b

SHA256: C30750656B85FBE71A2055CE8C406EBC7DF4873F4BC01BD848DD83EB1CE9353B

File Size: 4.37 MB, 4367472 bytes

MD5: 085c090e8c06787b03c2da6c2d50b80c

SHA1: b6df7a69a935542e850c2eb4cbed58ccf61ac8d4

SHA256: FEAECD211F868319269F16CE8723B27EF767D242841EFD4137BC588990D5CC53

File Size: 4.43 MB, 4430960 bytes

MD5: 1913ec5af7d5d72a097161f32aaceaac

SHA1: d2b78f8e7e67220f253a9cedcac9ce13239ebcdb

SHA256: E8FF5555949D79FECB0D05F5BB65857117FA04FEDBC9B44E62B678BF82FF7382

File Size: 84.96 KB, 84960 bytes

MD5: 31487ff55705b17f835136577b43d328

SHA1: 5b790f7cc9a7ba1e062858560b3eeaa47a551f10

SHA256: 5837BC26A73CFB46FFD466CF889F03CE2F6A48F1F3FD42EC8BE22189D51CAB1E

File Size: 1.20 MB, 1195520 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File has exports table
File has TLS information
File is 32-bit executable
File is 64-bit executable
File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)

File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Comments	Radmin - Remote Control Server Radmin Viewer
Company Name	Famatech Corp. Famatech International Corp. Flexera NetSupport Ltd Radmin System Ltd TektonIT
File Description	InstallShield Mesh Agent Service NetSupport Client Application Radmin Server component Radmin Viewer RMS System Application
File Version	V14.10 31.0.24 24.0.464 7.5.1.0 3, 5, 2, 0 3, 5, 0, 0 3, 0, 0, 5 1.00 0.2.1.3
Internal Build Number	182945 215864
Internal Name	BlkScrDl client32 MeshAgent Radmin rsl System32 TJprojMain _IsIcoRes.exe
Legal Copyright	Apache 2.0 License Copyright (c) 2018 Flexera. All Rights Reserved. Copyright (c) 2025 Flexera. All Rights Reserved. Copyright © 1999-2007 Famatech International Corp. and its licensors. All rights reserved. Copyright © 1999-2012 Famatech Corp. and its licensors. All rights reserved. Copyright © 1999-2017 Famatech Corp. and its licensors. All rights reserved. Copyright © 2024 TektonIT. Ter-Osipov Alex. All rights reserved. NetSupport Ltd © 2024 System Ltd © 2024
Legal Trademarks	Radmin, Remote Administrator
Original Filename	BlkScrDl.dll client32.exe MeshAgent.exe Radmin.exe rsl.exe System32.exe TJprojMain.exe _IsIcoRes.exe
Private Build	V14.10
Product Name	InstallShield Mesh Agent Service NetSupport Remote Control Project1 Radmin Server Radmin Viewer Remote Manipulator System System Control
Product Version	V14.10 31.0 24.0 7.5.1.0 3, 5, 2, 0 3, 5, 0, 0 3, 0, 0, 5 1.00 0, 0, 0, 0
Program I D	ru.rmansys.SfxExtractor

Digital Signatures

Signer	Root	Status
Famatech International Corp.	Class 3 Public Primary Certification Authority	Root Not Trusted
DATEV.it SRL	DigiCert Trusted Root G4	Root Not Trusted
IP Ter-Osipov Aleksey Vladimirovich	GlobalSign Code Signing Root R45	Root Not Trusted
Famatech Corp.	Symantec Class 3 SHA256 Code Signing CA	Hash Mismatch
Famatech Corp.	VeriSign Class 3 Code Signing 2010 CA	Hash Mismatch

Famatech Corp.	VeriSign Class 3 Public Primary Certification Authority - G5	Hash Mismatch
meshcommander.com	meshcommander.com	Self Signed

File Traits

2+ executable sections
big overlay
dll
HighEntropy
Installer Manifest
Installer Version
SusSec
x86

Block Information

Total Blocks:	3,986
Potentially Malicious Blocks:	158
Whitelisted Blocks:	2,014
Unknown Blocks:	1,814

Visual Map

0 0 ? 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 ? 0 0 ? ? 0 0 ? x 0 ? ? 0 0 ? ? ? 0 ? 0 ? ? ? x 0 0 0 0 0 ? 0 0 ? ? 0 ? ? ? 0 ? ? ? ? ? ? 0 0 ? 0 ? 0 ? 0 ? ? 0 0 ? ? ? 0 ? 0 ? ? ? 0 0 ? 0 0 ? 0 ? 0 ? ? ? ? 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? ? ? 0 ? 0 0 ? ? ? 0 0 0 0 ? 0 ? 0 ? x 0 0 ? ? ? ? ? ? 0 0 0 ? 0 0 0 ? 0 ? 0 0 ? 0 ? 0 0 ? 0 ? 0 0 0 0 x ? ? x ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 0 0 0 ? 0 ? ? x 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? ? ? x 0 0 0 ? ? 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 ? ? 0 ? ? ? ? ? ? ? 0 ? x ? 0 0 0 0 ? 0 0 ? ? ? ? 0 ? ? 0 ? ? 0 0 0 0 ? 0 ? ? 0 0 0 0 ? 0 ? ? 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? 0 0 ? 0 0 0 0 x ? ? ? ? x 0 0 0 0 0 0 ? 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? 0 0 ? ? ? 0 0 0 ? ? 0 0 0 ? 0 ? 0 ? ? 0 0 ? ? 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 ? ? ? ? 0 0 ? ? 0 ? 0 ? ? 0 0 ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 ? ? x x 0 ? ? 0 ? ? ? ? 0 0 0 0 0 ? 0 ? ? x 0 ? ? ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 0 ? ? 0 ? ? ? ? ? ? 0 0 0 0 0 ? ? 0 ? ? 0 ? ? 0 0 0 ? 0 ? 0 0 ? 0 ? 0 ? 0 0 ? 0 0 0 0 ? 0 ? ? 0 0 ? 0 ? ? 0 0 0 0 ? 0 0 0 0 ? 0 0 ? ? 0 ? x ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? 0 0 0 ? 0 ? ? 0 0 0 ? 0 ? ? 0 ? 0 ? ? 0 0 ? 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? ? 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 ? x 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 0 ? 0 0 ? 0 0 0 ? ? ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 ? ? 0 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? 0 0 ? 0 ? ? 0 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 0 ? 0 0 0 ? ? ? ? ? ? 0 0 0 ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? 0 0 0 ? 0 0 0 ? 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 ? 0 0 ? ? ? ? 0 0 ? 0 ? ? 0 ? ? ? 0 ? ? ? ? x ? ? 0 0 0 0 ? ? ? 0 ? ? ? 0 ? ? ? ? ? 0 0 ? ? 0 ? ? 0 ? ? ? 0 ? ? ? ? 0 0 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 0 ? ? 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? 0 ? ? 0 ? 0 ? 0 0 0 ? ? ? ? 0 ? 0 0 ? ? 0 ? x ? 0 0 0 0 ? 0 ? 0 0 ? 0 ? ? 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? ? ? ? ? ? 0 ? 0 ? 0 0 ? ? ? 0 ? 0 ? 0 ? 0 ? x 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? 0 ? x ? 0 0 0 ? ? ? ? 0 ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? 0 ? ? 0 ? 0 ? ? 0 0 ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 0 ? ? 0 0 0 ? ? ? ? 0 ? 0 0 0 ? ? ? ? ? 0 ? 0 0 ? 0 0 0 ? ? 0 0 ? ? ? ? ? ? 0 ? 0 ? ? 0 ? 0 0 ? 0 0 ? 0 ? ? ? 0 ? 0 0 0 x ? ? ? 0 ? ? ? 0 0 ? ? ? ? ? ? 0 0 ? ? ? 0 ? 0 0 ? ? 0 ? ? ? ? 0 ? 0 ? ? 0 0 0 0 0 ? ? 0 ? 0 0 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? 0 0 ? 0 ? ? 0 ? ? 0 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 ? ? 0 0 0 ? 0 0 ? ? 0 0 0 0 0 ? ? ? ? 0 0 0 0 ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 ? ? ? ? ? ? 0 0 0 0 0 ? 0 0 ? ? 0 ? 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 0 0 0 ? 0 0 ? ? 0 0 0 0 ? ? 0 0 ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 0 0 ? 0 0 ? ? ? ? ? 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 0 ? 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 ? ? 0 0 0 ? ? ? ? 0 0 ? 0 ? 0 0 ? ? ? 0 ? ? ? 0 ? ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? ? ? 0 ? ? 0 0 0 ? ? 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 ? 0 0 ? 0 ? ? ? 0 0 ? 0 0 ? 0 0 0 0 ? ? 0 0 ? 0 0 0 ? 0 0 0 0 x 0 0 x 0 ? ? x 0 ? ? 0 ? 0 0 0 0 ? 0 0 ? 0 0 0 0 ? ? 0 ? 0 0 0 0 x 0 0 0 0 0 ? ? ? ? 0 ? 0 ? ? 0 0 0 0 ? ? ? ? ? ? x 0 0 0 0 ? 0 ? 0 ? 0 ? ? ? 0 0 ? 0 ? ? 0 0 ? 0 0 ? 0 ? x ? 0 0 0 ? 0 ? 0 ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? 0 0 ? 0 ? ? ? ? ? 0 0 ? ? ? 0 ? 0 ? ? ? ? ? 0 ? ? ? 0 0 ? ? 0 ? ? 0 ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 0 ? 0 ? ? ? 0 ? ? 0 0 0 0 ? ? 0 ? 0 ? ? ?

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Agent.AVC
Agent.M
Agent.MAC
Agent.OFE
BadJoke.JB

BadJoke.XA
BadJoke.XAB
BadJoke.XAE
Filecoder.GYT
Filecoder.VBC
MeshAgent.A
Trojan.Downloader.Gen.NL
Trojan.Filecoder.Gen.AG
Vidar.FA

Files Modified

File	Attributes
c:\windows\system.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

Key::Value	Data	API Name
HKLM\system\controlset001\services\eventlog\application\screenconnect::eventmessagefile	C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey

HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1919251317	ª	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-456464662		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1462786655		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-912929324	#	RegNtPreCreateKey
HKCU\software\apcr\1214104697::1006321993	ĉ	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-1369393986	http://intercomplustula.ru/logo.gifhttp://gocekmanti.com/imag	RegNtPreCreateKey
HKCU\software\apcr\1214104697::549857331	f�P�(/� ��Z� �z��׉!�<Q��+�^�� ѩ�]T�u[L��m��Mgݾq��gR	RegNtPreCreateKey
HKCU\software\apcr::u1_0	㑞㗊	RegNtPreCreateKey
HKCU\software\apcr::u2_0	᫫	RegNtPreCreateKey
HKCU\software\apcr::u3_0	権ă	RegNtPreCreateKey
HKCU\software\apcr::u4_0		RegNtPreCreateKey
HKCU\software\apcr::u1_1	��	RegNtPreCreateKey
HKCU\software\apcr::u2_1	泺牥	RegNtPreCreateKey
HKCU\software\apcr::u3_1	ᥜ獦	RegNtPreCreateKey
HKCU\software\apcr::u4_1	獵牥	RegNtPreCreateKey
HKCU\software\apcr::u1_2	༾脦	RegNtPreCreateKey
HKCU\software\apcr::u2_2	앟	RegNtPreCreateKey
HKCU\software\apcr::u3_2	賃	RegNtPreCreateKey
HKCU\software\apcr::u4_2		RegNtPreCreateKey
HKCU\software\apcr::u1_3	㌣儵	RegNtPreCreateKey
HKCU\software\apcr::u2_3	䌆地	RegNtPreCreateKey
HKCU\software\apcr::u3_3	ぶ嘳	RegNtPreCreateKey
HKCU\software\apcr::u4_3	婟地	RegNtPreCreateKey
HKCU\software\apcr::u1_4	ᝦ쩾	RegNtPreCreateKey
HKCU\software\apcr::u2_4	헋즕	RegNtPreCreateKey
HKCU\software\apcr::u3_4	ꟽ좖	RegNtPreCreateKey
HKCU\software\apcr::u4_4	췔즕	RegNtPreCreateKey
HKCU\software\apcr::u1_5	ഄ汎	RegNtPreCreateKey
HKCU\software\apcr::u2_5	慄㯻	RegNtPreCreateKey
HKCU\software\apcr::u3_5	⭠㫸	RegNtPreCreateKey
HKCU\software\apcr::u4_5	䅉㯻	RegNtPreCreateKey
HKCU\software\apcr::u1_6	ꐆ	RegNtPreCreateKey
HKCU\software\apcr::u2_6	钴깠	RegNtPreCreateKey
HKCU\software\apcr::u3_6	��c�	RegNtPreCreateKey
HKCU\software\apcr::u4_6	뒾깠	RegNtPreCreateKey
HKCU\software\apcr::u1_7	뷻	RegNtPreCreateKey
HKCU\software\apcr::u2_7	ヾ⃆	RegNtPreCreateKey
HKCU\software\apcr::u3_7	䈚⇅	RegNtPreCreateKey
HKCU\software\apcr::u4_7	⠳⃆	RegNtPreCreateKey
HKCU\software\apcr::u1_8	룾긲	RegNtPreCreateKey
HKCU\software\apcr::u2_8	軡錫	RegNtPreCreateKey
HKCU\software\apcr::u3_8	鈨	RegNtPreCreateKey
HKCU\software\apcr::u4_8	鮨錫	RegNtPreCreateKey
HKCU\software\apcr::u1_9	꽧ﲳ	RegNtPreCreateKey
HKCU\software\apcr::u2_9	ᖃ֑	RegNtPreCreateKey
HKCU\software\apcr::u3_9	攴Ғ	RegNtPreCreateKey
HKCU\software\apcr::u4_9	༝֑	RegNtPreCreateKey
HKCU\software\apcr::u1_10	귋삚	RegNtPreCreateKey
HKCU\software\apcr::u2_10	齥矶	RegNtPreCreateKey
HKCU\software\apcr::u3_10	盵	RegNtPreCreateKey
HKCU\software\apcr::u4_10	芒矶	RegNtPreCreateKey
HKCU\software\apcr::u1_11	았瑫	RegNtPreCreateKey
HKCU\software\apcr::u2_11	폍	RegNtPreCreateKey
HKCU\software\apcr::u3_11	鰮	RegNtPreCreateKey
HKCU\software\apcr::u4_11		RegNtPreCreateKey

Windows API Usage

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey Show More ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory UNKNOWN win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetThreadState
Service Control	OpenSCManager OpenService StartServiceCtrlDispatcher
Process Shell Execute	CreateProcess ShellExecuteEx
Other Suspicious	AdjustTokenPrivileges SetWindowsHookEx
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserObjectInformation
Anti Debug	NtQuerySystemInformation
Encryption Used	BCryptOpenAlgorithmProvider
Network Winsock2	WSAStartup
Network Info Queried	GetHostName
Process Manipulation Evasion	NtUnmapViewOfSection

Shell Command Execution


							open RServer3.exe


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5b790f7cc9a7ba1e062858560b3eeaa47a551f10_0001195520.,LiQMAxHB

PUP.RemoteAdmin

Threat Scorecard

EnigmaSoft Threat Scorecard

What Is PUP.RemoteAdmin?

How PUP.RemoteAdmin Operates

Symptoms of Infection

How to Remove PUP.RemoteAdmin

Conclusion

SpyHunter Detects & Remove PUP.RemoteAdmin

File System Details

Registry Details

Directories

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

Digital Signatures

Digital Signatures

File Traits

Block Information

Block Information

Visual Map

Similar Families

Similar Families

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed