Overview

overview

7

Static

static

3

2026-05-07...lc.exe

windows10-2004-x64

7

2026-05-07...lc.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe
  • Size 17.8MB
  • Sample260507-mbcs1sbv41
  • SHA256 a42ead8ab0fabb39e376ef1ec193229609d393db6b5c41084d9bd31b63b0e5c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_1bad62ccf251e3bb7584b4f1d0067efe_icedid_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
      "C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
        "C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
          C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe /tray
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3428
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4244
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5008
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4048
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2444
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4128
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4696
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:400
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4120
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1192
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3528
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2856
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1752
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:720
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1112
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3416
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1996
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1144
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2920
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2424
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1604
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3600
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1848
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1916
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2600
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3896
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1716
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3984
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3516
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4800
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4224
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5080
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4676
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3616
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
        • Kills process with taskkill
        PID:4700
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
        3⤵
          PID:732
        • C:\Windows\system32\taskkill.exe
          "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
          3⤵
          • Kills process with taskkill
          PID:3176
        • C:\Windows\system32\taskkill.exe
          "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
          3⤵
            PID:3972
          • C:\Windows\system32\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
            3⤵
              PID:2080
            • C:\Windows\system32\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
              3⤵
              • Kills process with taskkill
              PID:3660
            • C:\Windows\system32\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
              3⤵
              • Kills process with taskkill
              PID:1208
            • C:\Windows\system32\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
              3⤵
              • Kills process with taskkill
              PID:4992
            • C:\Windows\system32\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
              3⤵
              • Kills process with taskkill
              PID:3080
            • C:\Windows\system32\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
              3⤵
                PID:1744
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                3⤵
                • Kills process with taskkill
                PID:2608
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                3⤵
                • Kills process with taskkill
                PID:1668
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                3⤵
                  PID:4728
                • C:\Windows\system32\taskkill.exe
                  "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                  3⤵
                  • Kills process with taskkill
                  PID:3532
                • C:\Windows\system32\taskkill.exe
                  "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                  3⤵
                    PID:1596
                  • C:\Windows\system32\taskkill.exe
                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                    3⤵
                      PID:1144
                    • C:\Windows\system32\taskkill.exe
                      "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                      3⤵
                      • Kills process with taskkill
                      PID:552
                    • C:\Windows\system32\taskkill.exe
                      "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                      3⤵
                      • Kills process with taskkill
                      PID:3056
                    • C:\Windows\system32\taskkill.exe
                      "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                      3⤵
                      • Kills process with taskkill
                      PID:64
                    • C:\Windows\system32\taskkill.exe
                      "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                      3⤵
                        PID:3964
                      • C:\Windows\system32\taskkill.exe
                        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                        3⤵
                          PID:3508
                        • C:\Windows\system32\taskkill.exe
                          "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                          3⤵
                          • Kills process with taskkill
                          PID:2948
                        • C:\Windows\system32\taskkill.exe
                          "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                          3⤵
                            PID:1844
                          • C:\Windows\system32\taskkill.exe
                            "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                            3⤵
                            • Kills process with taskkill
                            PID:868
                          • C:\Windows\system32\taskkill.exe
                            "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                            3⤵
                              PID:1760
                            • C:\Windows\system32\taskkill.exe
                              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                              3⤵
                                PID:5052
                              • C:\Windows\system32\taskkill.exe
                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                3⤵
                                • Kills process with taskkill
                                PID:3896
                              • C:\Windows\system32\taskkill.exe
                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                3⤵
                                • Kills process with taskkill
                                PID:456
                              • C:\Windows\system32\taskkill.exe
                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                3⤵
                                  PID:3384
                                • C:\Windows\system32\taskkill.exe
                                  "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                  3⤵
                                    PID:3052
                                  • C:\Windows\system32\taskkill.exe
                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                    3⤵
                                    • Kills process with taskkill
                                    PID:972
                                  • C:\Windows\system32\taskkill.exe
                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                    3⤵
                                      PID:2444
                                    • C:\Windows\system32\taskkill.exe
                                      "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                      3⤵
                                        PID:3472
                                      • C:\Windows\system32\taskkill.exe
                                        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                        3⤵
                                        • Kills process with taskkill
                                        PID:3528
                                      • C:\Windows\system32\taskkill.exe
                                        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                        3⤵
                                        • Kills process with taskkill
                                        PID:4288
                                      • C:\Windows\system32\taskkill.exe
                                        "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                        3⤵
                                          PID:4384
                                        • C:\Windows\system32\taskkill.exe
                                          "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                          3⤵
                                            PID:3564
                                          • C:\Windows\system32\taskkill.exe
                                            "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                            3⤵
                                              PID:2812
                                            • C:\Windows\system32\taskkill.exe
                                              "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                              3⤵
                                                PID:1324
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                • Kills process with taskkill
                                                PID:2856
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                • Kills process with taskkill
                                                PID:4548
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                • Kills process with taskkill
                                                PID:4404
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                • Kills process with taskkill
                                                PID:1588
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                • Kills process with taskkill
                                                PID:916
                                              • C:\Windows\system32\taskkill.exe
                                                "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                3⤵
                                                  PID:2600
                                                • C:\Windows\system32\taskkill.exe
                                                  "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                  3⤵
                                                    PID:3036
                                                  • C:\Windows\system32\taskkill.exe
                                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:3672
                                                  • C:\Windows\system32\taskkill.exe
                                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:2028
                                                  • C:\Windows\system32\taskkill.exe
                                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:1092
                                                  • C:\Windows\system32\taskkill.exe
                                                    "C:\Windows\system32\taskkill.exe" /F /IM ROMFUSClient.exe /T
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:3404

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    Config.xml
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\Config.xml
                                                    • Size 164KB
                                                    • SHA256 1198f6c0ad9847798211d4c7ccf7a843bda9014c998b33ddccb4da180d1a2461
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    English.lg
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\English.lg
                                                    • Size 87KB
                                                    • SHA256 20db884523da62c20f80b8a3bb71e11091b90a443b83c06d8fe2a1bbc00c1c33
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ROMFUSClient.exe
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\ROMFUSClient.exe
                                                    • Size 6.0MB
                                                    • SHA256 33d1a34fec88ce59beb756f5a274ff451caf171a755aae12b047e678929e8023
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ROMServer.exe
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\ROMServer.exe
                                                    • Size 7.4MB
                                                    • SHA256 162061884914970a39cb80ef274ee07b0d398fab509d7c9b5dffe911b6dfbc8d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Russian.lg
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\Russian.lg
                                                    • Size 92KB
                                                    • SHA256 302373d81f0ae15589206420cb01a266804c9fd1c1ff0d6e09ce6ba3fef92b64
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    romlaunch.exe
                                                    • Path C:\Users\Admin\AppData\Roaming\screen\romlaunch.exe
                                                    • Size 136KB
                                                    • SHA256 4abfecf8d07a86bb021440387cb667dfdc4ebcb5f073f0ee40972607aea28b30
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/2800-26-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-29-0x0000000002DB0000-0x0000000002DC9000-memory.dmp
                                                    Download

                                                    memory/2800-23-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-53-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-17-0x00000000009F6000-0x00000000009F8000-memory.dmp
                                                    Download

                                                    memory/2800-27-0x00000000009F6000-0x00000000009F8000-memory.dmp
                                                    Download

                                                    memory/2800-28-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-18-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-30-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-31-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-39-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-43-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-49-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/2800-51-0x0000000000400000-0x0000000000BF2000-memory.dmp
                                                    Download

                                                    memory/3428-25-0x0000000000400000-0x0000000000A92000-memory.dmp
                                                    Download