Overview

overview

10

Static

static

3

2026-09-01...om.exe

windows10-2004-x64

10

2026-09-01...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/09/2026, 20:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-01_29e9b97cc3cd5c0d925729e3d79b7afa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 65.7MB
  • Sample260901-y4h2aaef43
  • SHA256 da9b9dc9606276c01e5dcea17c9e6793c9312250d468f99b1be1b419cc16f52f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
youtubedefense_evasiondiscoveryexecutionsheetratinstallerpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 2.6

Campaign

  • youtube

C2

  • 2.27.20.169:34267

Mutex

  • fwqsqkvztwrnsqug

Attributes
  • ddr

    IPMODE

  • hidden_file

    true

  • install

    true

  • install_watch_dog

    true

  • path_client

    %ProgramFiles%\SystemUpdate

  • path_watch_dog

    %ProgramFiles%\MicrosoftCore

  • pump

    true

  • rootkit

    true

  • user_init

    true

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 18 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 46 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-01_29e9b97cc3cd5c0d925729e3d79b7afa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-01_29e9b97cc3cd5c0d925729e3d79b7afa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\2026-09-01_29e9b97cc3cd5c0d925729e3d79b7afa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-01_29e9b97cc3cd5c0d925729e3d79b7afa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
          4⤵
          • Views/modifies file attributes
          PID:2572
      • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Users\Admin\AppData\Local\Temp\is-1V3EB.tmp\RuntimeBroker.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-1V3EB.tmp\RuntimeBroker.tmp" /SL5="$90044,47540821,796160,C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\system32\attrib.exe
          attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
          4⤵
          • Views/modifies file attributes
          PID:2576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe"
          4⤵
          • Views/modifies file attributes
          PID:5868
      • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "core" /tr "C:\Program Files\SystemUpdate" & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3560
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "core" /tr "C:\Program Files\SystemUpdate"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5872
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3172
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftUpdate" /tr "C:\Program Files\MicrosoftCore" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3496
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftUpdate" /tr "C:\Program Files\MicrosoftCore" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5116
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2668
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2440
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4760
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:792
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4696
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2908
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1436
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1256
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4868
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2348
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4216
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4128
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5740
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4364
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1132
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4156
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5132
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:3416
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1256
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3444
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5792
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2332
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3096
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:3336
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1768
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:200
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3160
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:5816
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2752
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:5148
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3784
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:4596
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:952
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:4888
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2296
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:1284
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5952
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:4908
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2456
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:2340
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5096
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:1236
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2828
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:956
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4196
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:3096
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4980
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:2104
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:932
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:1124
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5224
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:1924
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2000
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:3088
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5232
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:4696
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1772
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:2428
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4064
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:4296
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2348
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          PID:5740
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "MicrosoftStoreUpdate" /tr "C:\Program Files\SystemUpdate" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4680
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E08BF14AF6BF23AD6DEBA20FD2FEA18B
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3836
    • C:\Windows\Installer\MSI8796.tmp
      "C:\Windows\Installer\MSI8796.tmp" install "C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf" "C:\Program Files (x86)\Radmin VPN\Driver.1.0\NetMP60.inf" ad_InstallDriver_64 "C:\ProgramData\Famatech\Radmin VPN\RadminVPN_msi_2.0.4899.9_20260901_212059.txt"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5460
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3DAE4812B5B19D313E0EF17F3A277B56 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN Control Service" dir=in action=allow program="C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" enable=yes profile=any edge=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2464
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN icmpv4" action=allow enable=yes dir=in profile=any remoteip=26.0.0.0/8 protocol=icmpv4
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2020
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "1" "c:\program files (x86)\radmin vpn\driver.1.1\netmp60.inf" "9" "42f731a47" "00000000000000E0" "WinSta0\Default" "000000000000011C" "208" "c:\program files (x86)\radmin vpn\driver.1.1"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3480
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /minimized
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2740
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\netmp60.inf_amd64_f32b93923791d26a\netmp60.inf" "oem1.inf:c36c271bc64eefc9:RVpnNetMP.ndi:15.39.54.8:{b06d84d1-af78-41ec-a5b9-3cce676528b2}\rvnetmp60," "42f731a47" "00000000000000E0" "5deb"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2296
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1220
    • C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe
      "C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" /service
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh.exe interface ipv4 set interface interface="Radmin VPN" metric=1
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe interface ipv4 set interface interface="Radmin VPN" metric=1
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2104
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh.exe interface ip delete route prefix=0.0.0.0/0 interface="Radmin VPN"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe interface ip delete route prefix=0.0.0.0/0 interface="Radmin VPN"
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3344
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh.exe interface ip add route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1 publish=Yes metric=9256
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe interface ip add route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1 publish=Yes metric=9256
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4296
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh.exe interface ip add address name="Radmin VPN" addr=26.194.175.195 mask=255.0.0.0 gateway=26.0.0.1 gwmetric=9256
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe interface ip add address name="Radmin VPN" addr=26.194.175.195 mask=255.0.0.0 gateway=26.0.0.1 gwmetric=9256
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4752
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\system32\netsh.exe interface ipv6 add address interface="Radmin VPN" address=fdfd::1ac2:afc3
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5536
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\system32\netsh.exe interface ipv6 add address interface="Radmin VPN" address=fdfd::1ac2:afc3
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5916
    • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
      "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      PID:980
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4396
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
      1⤵
      • Modifies security service
      • Suspicious behavior: EnumeratesProcesses
      PID:2996

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          2
          T1546

          AppInit DLLs

          1
          T1546.010

          Netsh Helper DLL

          1
          T1546.007

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          2
          T1546

          AppInit DLLs

          1
          T1546.010

          Netsh Helper DLL

          1
          T1546.007

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59625d.rbs
          • Path C:\Config.Msi\e59625d.rbs
          • Size 642KB
          • SHA256 bd73ef42bf22ad305c5582ae9dd4ef067cc21a13e2cfc32e3e08644622bada70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetMP60.inf
          • Path C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf
          • Size 5KB
          • SHA256 ef6769520c94a3b5885458cd19696b45cf79010e9757729b2049ba6782fecfd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Core.dll
          • Size 5.2MB
          • SHA256 660b556a17bf583ba420a96f439d21e5034ac17778df4018442f137e18c2003f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Gui.dll
          • Size 5.9MB
          • SHA256 5a817f5597a950fd41d14d9ed5b35f8b1df689487d4651d5c358d2bab6927930
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Network.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Network.dll
          • Size 822KB
          • SHA256 c1100b00e1de5d85c751a1ad87e5b1c26b71a2c334637b5ce2f4cea325fa87a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Qml.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Qml.dll
          • Size 2.9MB
          • SHA256 dcac17fd36ce0b539bd214f9ec988f08cc11878eb7857f5e492c0fc402621755
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5QmlModels.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5QmlModels.dll
          • Size 348KB
          • SHA256 ea14e8255217f81e968c6459a689cfbfe6ca1d93a1f5dba694078f6b100feb26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Quick.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Quick.dll
          • Size 3.4MB
          • SHA256 17117cba5d56eb4d5263070f195d1f137605e2f102f3d1d88b8c1faec8dc0fda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5QuickControls2.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5QuickControls2.dll
          • Size 144KB
          • SHA256 d62f8b7a2418a12e1147128a304cf7aa9057aebf6ca37b222fade8a15892b085
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5QuickTemplates2.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5QuickTemplates2.dll
          • Size 938KB
          • SHA256 c865dcd5f5e3770c2adad931e33f3c536bef8e39b3918336c6ed4a7b37611532
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Svg.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Svg.dll
          • Size 262KB
          • SHA256 6d18b5ffa1d28dad86a352768fc9a9421dfbd7af2c3ea71f50e9d3361248b8cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5Widgets.dll
          • Size 4.3MB
          • SHA256 7afa3bbf0544d7e98fc4ecc99b555ff5b234255eb8cbf9ee22189e447cee67e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WinExtras.dll
          • Path C:\Program Files (x86)\Radmin VPN\Qt5WinExtras.dll
          • Size 201KB
          • SHA256 2fe3ddc6fd99ebc382a5ff1bc352cfdb53c94fdce7d21bf0f5e0129c19b07c3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RvRvpnGui.exe
          • Path C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
          • Size 12.9MB
          • SHA256 c666b84c4d77c01e54c7172f54093521466ba0f14303409d1563e63f4365c9e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudt74.dll
          • Path C:\Program Files (x86)\Radmin VPN\icudt74.dll
          • Size 29.4MB
          • SHA256 8bb66a3de339e3f23c01ebf0b132ecd03aead6f341a695f098851c3d240ddbec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icuin74.dll
          • Path C:\Program Files (x86)\Radmin VPN\icuin74.dll
          • Size 2.7MB
          • SHA256 e420c252b9da583195127b6d8b398b80917475cef43d24ae5684261000b208a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icuuc74.dll
          • Path C:\Program Files (x86)\Radmin VPN\icuuc74.dll
          • Size 1.8MB
          • SHA256 f0d449374122d97c315566ef9dc4ccaad2994a93f0fd921569ec65d2711ed68b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Program Files (x86)\Radmin VPN\msvcp140.dll
          • Size 438KB
          • SHA256 2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_1.dll
          • Path C:\Program Files (x86)\Radmin VPN\msvcp140_1.dll
          • Size 20KB
          • SHA256 65bdadb5562b9473471740b1dcd8b064459a40d71a1a11fc5aedaa855fe7635a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qwindows.dll
          • Path C:\Program Files (x86)\Radmin VPN\platforms\qwindows.dll
          • Size 1.2MB
          • SHA256 70ebfa4917293007131c736730af5ad4911c7b9b08dfd11c03bf86f249970ae8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qt_gd.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_gd.qm
          • Size 70B
          • SHA256 49df855a004a17950338af3146466f6df4d5852410bd0b58ea80e0d0203a9d24
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qt_he.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_he.qm
          • Size 83B
          • SHA256 c113d14e218d5402b616dabea27969c6f83852676468c5ef051dddefb3ee0235
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qt_lv.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_lv.qm
          • Size 89B
          • SHA256 03467738042a15676e504ba02cb326dcdb773b171fada3cd62b7a0e0564314a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qt_pl.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_pl.qm
          • Size 161B
          • SHA256 bd7dd0c2cab119a973dc10c3bff7499d9728b928b541f86056921b30c8db78e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qt_sk.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_sk.qm
          • Size 157B
          • SHA256 b6adffd889ff96bf195cb997327e7d7005a815cad67823fa6915a19c2d9bb668
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qt_zh_TW.qm
          • Path C:\Program Files (x86)\Radmin VPN\translations\qt_zh_TW.qm
          • Size 141B
          • SHA256 751ecda0c33e061d91241268357fbd2f6b7f70a1116e714f28d22efd61ec7a1a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files (x86)\Radmin VPN\vcruntime140.dll
          • Size 78KB
          • SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RadminVPN_msi_2.0.4899.9_20260901_212059.txt
          • Path C:\ProgramData\Famatech\Radmin VPN\RadminVPN_msi_2.0.4899.9_20260901_212059.txt
          • Size 1KB
          • SHA256 1ce4388e6f79f20a291106318de9781015e9b9835feadaf8be72e6b3301a7c97
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RuntimeBroker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
          • Size 46.4MB
          • SHA256 87c1be4f631796c635797b789cc82064ac7bbfce34cdbe1e0003178bf93e81e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RuntimeBroker_1.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_1.exe
          • Size 101KB
          • SHA256 7ca66fc932400e62e13e47193126f4201af0bd28ff68d62a9d5104728a6d7f38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\_bz2.pyd
          • Size 82KB
          • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\_lzma.pyd
          • Size 154KB
          • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\base_library.zip
          • Size 1.3MB
          • SHA256 c7b3b20d8302c077fc8f1fc38bddf35251647391ef8cb62f50f08f08f78850d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\python313.dll
          • Size 5.8MB
          • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e942\ucrtbase.dll
          • Size 1.1MB
          • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RuntimeBroker.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-1V3EB.tmp\RuntimeBroker.tmp
          • Size 3.0MB
          • SHA256 9f50fe9835f39105a7fbe0787a56bd1f08fa0382214ef019181f6933a09ce3b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RadminVPN_2.0.4899.9.msi
          • Path C:\Users\Admin\AppData\Local\Temp\is-3H741.tmp\RadminVPN_2.0.4899.9.msi
          • Size 44.5MB
          • SHA256 7372dc166ab7082f187850bafdf85e5f3876cf7c3c0c5fa8c1125b6fa2dcc8d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Rvis_install_dll.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-3H741.tmp\Rvis_install_dll.dll
          • Size 140KB
          • SHA256 2c95e07686ce8283fd2e57a9b49bd89944890bcc27e12e6d5750b34795cf1fa3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI8796.tmp
          • Path C:\Windows\Installer\MSI8796.tmp
          • Size 410KB
          • SHA256 794ea711c9c887bbf03c29da0fd9077ab56e9ea48e3dba7ddd28f25ce138a02a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netmp60.inf_amd64_f32b93923791d26a.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\netmp60.inf_amd64_f32b93923791d26a.ini
          • Size 418B
          • SHA256 dd3dad185acae24902ea38676fc9bf2eab7df3f3c55e9b0850363f724b682ccd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RvNetMP60.sys
          • Path \??\c:\PROGRA~2\RADMIN~1\DRIVER~1.1\RvNetMP60.sys
          • Size 56KB
          • SHA256 88765957ac41e3f00f1fd98393342ea40ddcc05952aba418e099d866296c1bf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetMP60.cat
          • Path \??\c:\program files (x86)\radmin vpn\driver.1.1\NetMP60.cat
          • Size 10KB
          • SHA256 6ba444527b66803b9fa43b80509788c761fa18b52360e27b74cc2e8a1c115b3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/720-73-0x000001DCF5EC0000-0x000001DCF650C000-memory.dmp
          Download

          memory/2092-72-0x0000000000C40000-0x0000000000C60000-memory.dmp
          Download

          memory/2740-1038-0x0000000009660000-0x0000000009AA2000-memory.dmp
          Download

          memory/2740-1040-0x0000000009AB0000-0x0000000009CB2000-memory.dmp
          Download

          memory/4816-89-0x0000000000400000-0x00000000004D0000-memory.dmp
          Download

          memory/4816-67-0x0000000000400000-0x00000000004D0000-memory.dmp
          Download

          memory/4816-1148-0x0000000000400000-0x00000000004D0000-memory.dmp
          Download

          memory/5764-90-0x0000000000400000-0x0000000000703000-memory.dmp
          Download

          memory/5764-1066-0x0000000000400000-0x0000000000703000-memory.dmp
          Download

          memory/5764-1147-0x0000000000400000-0x0000000000703000-memory.dmp
          Download