ee0a4294237de535ece0b71044c8eaa58135dd901ec603b082465b4af9fd5cfd

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Size 41.0MB
Sample260728-e172fsaq6y
SHA256 ee0a4294237de535ece0b71044c8eaa58135dd901ec603b082465b4af9fd5cfd
MD5 da7e13c82ff1a15d7b61b572a5c18666
SHA1 5e447a4718eb2eb13dc47a7bc20f7a5f461922cc
SHA512 f827327b45d52d487c21245f5f4151723e8112f63d73b51bc38c6da9b5a462229397b5039632d70de04e236fcd25955be3648756ebc38d72f721dbdbe4f9cf1c
SSDEEP 786432:JF4n1buOzOsZT3Mfjanv/QpEcCqjjfoWOQYTxCv88t8HtVyXV:XuxuOz5Zjrng6nIe4v88+HDM
TLSH
T1BF9733237B82CB74E0FA50B08D566B689941BC7597219BCBB3AA32FF18716D067317C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 54 IoCs

pid	Process
980	MsiExec.exe
980	MsiExec.exe
980	MsiExec.exe
980	MsiExec.exe
980	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
5612	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
5612	MsiExec.exe
4576	MsiExec.exe
980	MsiExec.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler\ = "{83D96563-DB11-42DF-92F9-32CE7BA54ED8}"	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\N:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\P:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\V:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\H:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\D:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\I:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\S:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\U:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\X:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\O:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\315.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\uspto\files\iso9573-13\isoamsa.ent	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-dse-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-othliab-pre-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\dis\us-gaap-dis-cc-pre-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\AltovaText\EDI\EDIX12DataCompletion.cpp	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\java\library\xml\LibraryNode.java	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\EDIFACT\CALINF.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\EDIFACT\RECORD.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\voicexml\files\vxml-synthesis-extension.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-leacap-pre-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\non-gaap\ar-std-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\dis\us-gaap-dis-ero-pre-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-ci-soi-cal-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\QSX_J02.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\180.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\432.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\java\files\application_1_3.dtd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\xsl\files\xsl_fo.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-inctax-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\dis\us-gaap-dis-fifvd-def-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-soi-int-def-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\LibraryDB\LibraryDB2005.vcproj	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\java\altova\xml\XsValidation.java	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\EDIConfig.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-sec-reins-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\AltovaXML\MSXML\MFNodeAdapters_DOM.cpp	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\AltovaXML\XmlException.cpp	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\ADT_A24.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\MFN_M11.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\RSP_E03.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\176.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-rlnro2-cal-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\elts\us-types-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-bd-spc-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-spc-cal-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\dis\us-gaap-dis-fs-bt-def-2009-01-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\SRM_S04.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\874.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\DocBook\files\ent\isonum.ent	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\UBL\files\codelist\UBL-CodeList-AllowanceChargeReasonCode-1.0.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\dita\files\commonElements.mod	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\185.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\math\files\presentation\table.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-leasl-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-basi-scf-dbo-pre-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-scf-inv-def-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\AltovaFunctions\AltovaFunctions2005.vcproj	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\Mapforce\AlgorithmGroup_Exec.spl	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cs\AltovaText\EDI\ServiceChars.cs	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\java\altova\text\edi\EDIX12Settings.java	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-ci-soi2-pre-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\catalog.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\AltovaText\ColumnSpecification.h	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\cs\AltovaText\TextNodeCollection.cs	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\spl\java\altova\types\SchemaDate.java	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\HL7\RSP_Z88.config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\815.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\MapForce2011\MapForceEDI\X12\831.Config	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\Schemas\xmlspec\files\xmlspec.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\dis\us-gaap-dis-eps-pre-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-com-2008-03-31.xsd	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-scf-indir-def-2008-03-31.xml	msiexec.exe
File created	C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\dis\us-gaap-dis-dse-pre-2009-01-31.xml	msiexec.exe

Drops file in Windows directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIAB18.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE471.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Downloaded Installations\{BE84735E-053F-4517-886D-D9786522B7FA}\Altova MapForce 2011 Enterprise Edition.msi	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7773.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7978.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FAD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6ce6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF73E33868AA5F5B80.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BD0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADDC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE510.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\MapForceFlexText.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6ce4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB022.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE61C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9FB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF16DA07011123F376.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI926D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD7F39131B5B8A7C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE718.tmp	msiexec.exe
File created	C:\Windows\Downloaded Installations\{BE84735E-053F-4517-886D-D9786522B7FA}\Altova MapForce 2011 Enterprise Edition.msi	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Installer\MSI83CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD6D.tmp	msiexec.exe
File created	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\MapForceFlexText.exe	msiexec.exe
File created	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\MapForce.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8527.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE64C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE94D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\MapForce.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI952D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE54F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI809E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI836F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA868.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDD49A625A30C8B34.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE58F.tmp	msiexec.exe
File created	C:\Windows\Installer\{ACE52A7C-31A8-4660-A2BA-02B70CAA5BB2}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e5a6ce4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE3A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE99C.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FDD882A-3428-4A16-9DDA-13C7D8F1EEAE}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62434B8C-94E8-4F91-9B8F-1F635F4172EE}\TypeLib\Version = "4.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfd.2011\Shell\Edit_with_Altova_MapForce\Command	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfp.2011	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E3ED8925-24E0-476D-9A0B-732ECAD706AF}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA46629A-45E1-4141-9B39-3FBBDB733B04}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FFB4E0A-97C9-4D9F-A123-9263020352DC}\TypeLib\Version = "4.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DF03726-7F07-472F-AAEE-E95ED45B8B4E}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEDBCE9C-9BF7-435D-836E-CAEEFC3258B6}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\LICENS~1.EXE	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3ED8925-24E0-476D-9A0B-732ECAD706AF}\VersionIndependentProgID\ = "MapForceFlexText.Application"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D360EF5-2EB3-49B2-807A-1FC2950EC799}\ = "MapForce Application Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C735E1D-9854-45A5-8293-BED62C85E1E9}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mff.2011\Altova\Open	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LicenseKeyUpdate.altova_licenses.2011\Altova	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F59F825-0CEF-4157-AB81-D27283915953}\TypeLib\Version = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F59F825-0CEF-4157-AB81-D27283915953}\ = "_IDocumentEvents"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82054121-4ED6-480F-8544-D7EDBF5F172A}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C182820-83A8-4065-86E9-99890E0241EA}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfp.2011\Shell\Edit_with_Altova_MapForce\Command\ = "\"C:\\PROGRA~2\\Altova\\MAPFOR~1\\MapForce.exe\" /dde"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.Application.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06490DFB-93A8-4301-AA9C-F22B4AACF056}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C182820-83A8-4065-86E9-99890E0241EA}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C182820-83A8-4065-86E9-99890E0241EA}\ = "_IAppOutputLineEvents"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mff.2011\Altova\ = "Altova MapForce Function Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfp.2011\MapForce.2011 = "Altova MapForce Project"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{60A8541B-0C5C-41D8-A584-D68B05F2C073}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAFDF390-242A-4ACF-88C1-D9DCE9CDE86E}\ = "IDatapoint"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A681C1A9-4C7D-4148-AF77-2231D564CD08}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3567D641-9E39-49ED-AE12-A7A2EBB9BE46}\TypeLib\ = "{BDA2FCA6-C4E9-46FB-B157-80980A86D686}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A2CFB81-90D4-4EB8-9D63-EEA22682EFB4}\TypeLib\ = "{BDA2FCA6-C4E9-46FB-B157-80980A86D686}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mft.2011\Shell\Open\Command	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfp.2011\Altova	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mftfile\shell\Open\ddeexec\ = "[open(\"%1\")]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06490DFB-93A8-4301-AA9C-F22B4AACF056}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B8FFBD2-4955-4B58-9AEB-225E5CA20A52}\ = "_IApplicationEvents"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B8FFBD2-4955-4B58-9AEB-225E5CA20A52}\TypeLib\ = "{A681C1A9-4C7D-4148-AF77-2231D564CD08}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfd.2011\Shell\ = "Edit_with_Altova_MapForce"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06490DFB-93A8-4301-AA9C-F22B4AACF056}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEDBCE9C-9BF7-435D-836E-CAEEFC3258B5}\TypeLib\ = "{BDA2FCA6-C4E9-46FB-B157-80980A86D686}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D6379586-85EA-44C7-8DB4-CABE4127E120}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C7A25ECA8A1306642AAB207BC0AAB52B\InstallerOptionsInstallDropHandler_Generic = "InstallerOptions_Generic"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MapForce.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfd.2011\Shell\Edit_with_Altova_MapForce\ddeexec	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA46629A-45E1-4141-9B39-3FBBDB733B04}\ = "IDocuments"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{213DC7B1-8FC6-45DD-A629-8E0FE437A62B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06490DFB-93A8-4301-AA9C-F22B4AACF056}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mft.2011\DefaultIcon\MapForce.2011 = "C:\\Program Files (x86)\\Altova\\MapForce2011\\file_mft.ico,0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FDD882A-3428-4A16-9DDA-13C7D8F1EEAE}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C7A25ECA8A1306642AAB207BC0AAB52B\MapForceEnterprise_ExamplesAllEditions = "MapForceEnterpriseExamples"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mff.2011\Shell\Edit_with_Altova_MapForce\Command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.altova_licenses\OpenWithList\LICENS~1.EXE\ProgId = "LicenseKeyUpdate.2011"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mfffile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA46629A-45E1-4141-9B39-3FBBDB733B04}\TypeLib\ = "{A681C1A9-4C7D-4148-AF77-2231D564CD08}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{213DC7B1-8FC6-45DD-A629-8E0FE437A62B}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06490DFB-93A8-4301-AA9C-F22B4AACF056}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B8FFBD2-4955-4B58-9AEB-225E5CA20A52}\TypeLib\ = "{A681C1A9-4C7D-4148-AF77-2231D564CD08}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3567D641-9E39-49ED-AE12-A7A2EBB9BE46}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CFCFF72-CEDB-4583-A050-D25430D63811}\TypeLib\ = "{BDA2FCA6-C4E9-46FB-B157-80980A86D686}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfd.2011\Shell\Open\ProgId = "MapForce.2011"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MapForce.mfd.2011\DefaultIcon\ = "C:\\Program Files (x86)\\Altova\\MapForce2011\\file_mfd.ico,0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LicenseKeyUpdate.altova_licenses.2011\Shell\Open\ProgId = "LicenseKeyUpdate.2011"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mfffile\shell\Open	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	msiexec.exe
3928	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeIncreaseQuotaPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSecurityPrivilege	3928	msiexec.exe
Token: SeCreateTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeLockMemoryPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeIncreaseQuotaPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeMachineAccountPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeTcbPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSecurityPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemProfilePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemtimePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeProfSingleProcessPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeIncBasePriorityPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreatePagefilePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreatePermanentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeRestorePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeShutdownPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeAuditPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemEnvironmentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeChangeNotifyPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeRemoteShutdownPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeUndockPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSyncAgentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeEnableDelegationPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeManageVolumePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeImpersonatePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreateGlobalPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreateTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeLockMemoryPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeIncreaseQuotaPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeMachineAccountPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeTcbPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSecurityPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemProfilePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemtimePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeProfSingleProcessPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeIncBasePriorityPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreatePagefilePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreatePermanentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeRestorePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeShutdownPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeAuditPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSystemEnvironmentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeChangeNotifyPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeRemoteShutdownPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeUndockPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeSyncAgentPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeEnableDelegationPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeManageVolumePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeImpersonatePrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreateGlobalPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeCreateTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeLockMemoryPrivilege	408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
408	2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
3928	msiexec.exe
980	MsiExec.exe
4576	MsiExec.exe
5612	MsiExec.exe
5952	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 980	3928	msiexec.exe	90
PID 3928 wrote to memory of 5856	3928	msiexec.exe	97
PID 3928 wrote to memory of 4576	3928	msiexec.exe	99
PID 3928 wrote to memory of 5612	3928	msiexec.exe	100
PID 3928 wrote to memory of 5952	3928	msiexec.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_da7e13c82ff1a15d7b61b572a5c18666_amadey_elex_remcos_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4E94958100B9844EBE89E11A654C3C48 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:980
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE3142379743CFCB2231222F26E4F437
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D00C28997AC4499ADD307E2E829A380C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04D0C9F518A216B11F34E5D781B2C4B1 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a6ce5.rbs

Path C:\Config.Msi\e5a6ce5.rbs
Size 9.0MB
SHA256 06d828144bc520564fcc6637a5d7a39a15e9df449a40a07b38bcfbfccc0f24ee
MD5 3ad3f98c4bee58ea1f7e1fe0ed44f1b7
SHA1 8d3e6cb67c3b0353a6bb54e333245120ed10779e
SHA512 60b314a923b48c6d7a75cbb548605716c43f8ddfbbe708aceff5cbc3d60e412ad0b6ec1e13acfb621d85f90c67541a87895c00aa7596c43ab80d092ebdab9a6f
SSDEEP 98304:qBU/lBU/+BU/FBU/5BU/gBU/qBU/GBU/YBU/FBU/UBU/0BU/wBU/uBU/aBU/l:qULiqdRDr+zrV9Rq
TLSH
T18E968E116BE9C0B1F19E26B41679D62C94B9BD645F38D6DF63880A2F1E306C0BD78327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sic-ref-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\non-gaap\sic-ref-2008-03-31.xml
Size 391B
SHA256 f9fbe4b529423446610cd1db3a318ae532d0fc91807fa5e299621d1a3e269c58
MD5 89a5d4ee58e6778edead2af1bc44514d
SHA1 7d2903d0ac4cf383d25776ec845ebb2cdff4e97d
SHA512 2ab3c638363aae775d3d840f55312ec1d158190a440a1c4817ffe2f18394217e31b0aa0c86d2aa3228289126e6d3dbafd07fbb5388b8a1af9f2d78fc81887402
TLSH
T123E0C9DCD4BC9000A642EA41F2FDBF38C82674A6DFE456C6D0710E61B0233413143759
MD5 SHA1 SHA512 TLSH

Submit Download

us-gaap-stm-re-com-pre-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-com-pre-2008-03-31.xml
Size 20KB
SHA256 b146447015248be0c7cff5013e4369f8cdcee7292155c35844bbe5cd07456897
MD5 f36cf4ccd323107d80fcb13ec19e4339
SHA1 d8c9dfc1a6b5995ad561ec583234e10f5358c08d
SHA512 0694c87bd572b81ba653f34dd4b21a063b13100c6e67c9bff5b5703862842bbc1640878ca18389825fb4b9f3d4b92c36ff2e77c6d4a3faa6c13ca55bf883b547
SSDEEP 192:OwcGoN/x1tv2Y6xI7/c8QUGiLXrXpRoYlaZaD/uTW01k1G1v1w1xO7qZ3qe7qhSM:OwFokiLrcYQsD/n0E2NAK1DLBR
TLSH
T19692334C54C728506B5EF82EED68ED29E11A5DB1D25B0257E020FD6E9023F397BF228D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci-cal-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-sheci-cal-2008-03-31.xml
Size 46KB
SHA256 9cf306bda758e408abe4902c7636fba8ec641fde9a8dc9d48c35eac01d2ea5ba
MD5 e86d95b2abd0a7aa8001502c7a2da7fb
SHA1 83d7dda6eb24619f40fb7fac90e8a8614bcb2a2b
SHA512 d2f2e7a61b4a7d453ba5c396a788489b983937b97df4bf10a13c2e3db0ab97c97a0a70f5712472507ebd42f2f2b27c48f14c1b7b90510f3a1507ae8994070819
SSDEEP 768:ORhGozNp/xRrAd++3w5aJaHZUxDgxJiwZLWM:vo35RrZ+3wT+DgxQwZL/
TLSH
T130236D1C40E358125A6BB53BCE299C1DD29D58F0A62F1163D126FD2E80A7B3837F36D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci-pre-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-sheci-pre-2008-03-31.xml
Size 67KB
SHA256 c5e803584a85807f033e5799c98d001783468f066927916bfa93a5f72fa5287c
MD5 bc5b44bad3dba99cd9ff0c1e87c13eb9
SHA1 316f88b4406dcf759367f45a4fc7f51139dacb84
SHA512 d71e24367ceab3b147bab1314b5b4f380224058271c2b62be47134bfe6792be420acd434c267ff5ddb300e58956de962511e8830ce83c90d66b801914a544d08
SSDEEP 768:OZokWl5rkemwSdkaS+MhYo5NF/x7DAMw8BLjDhBRbA45aVN5/dIPom6dtRU3OYvx:3l5rkemwf+doV5lBRbA45aVN5m2QOc
TLSH
T1D963AB1C54E368511B5AB82ADE79AC1DD26D58F1D62F0163E026FD1E40A7F3C3BB3289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci2-cal-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-sheci2-cal-2008-03-31.xml
Size 15KB
SHA256 758f67e86a5c3e3f4194b179339d5e52226d933cf63131df1efebd60757dc47b
MD5 ce394ea9dffa3c32bdb539c4992e4e27
SHA1 8bb669465977aa1db74e74b78ce69ec3d9f6fc00
SHA512 23611f018c2b1c82dd1ce477f1efada1939d86d6073ae8ac3407f0ba7a23661891cea151e7a7a7b35e73bcbd02aa7ac47a95f7aceaab61164a6a026a5814c4bb
SSDEEP 192:Owmh7lHFhdAca56U8vRddWYp597nN5yv3MFpFZ1xqOJ96mums1LCp1nEdgogFf0P:OwAN2DMZL0
TLSH
T15262BD28449648111E27F92BDF6A6C1ACE99E8F0B21F0553E625FC1E50A7B2C33F36D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc-cal-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-soc-cal-2008-03-31.xml
Size 38KB
SHA256 d3dfbc7c823e396e1ab18cac315bb390f40d349ebbf78358d74eb5744744e612
MD5 574c40778d60858d909c3d70df0879ce
SHA1 514b3452cfa51662f7556eefe9d17d71d80b357b
SHA512 0f361e9a96aeec444c5a460e5d1cc46535bfc37f7327fc292ca93229800d52c1d01a46dcb632d1560e8c032d1415644a15b9decb84f86c9bc2f5d107ad7d5cca
SSDEEP 192:Owbh7lHFhdAca56U8vRddWYp597nN5yv3MFpFZ1xqOJ96mums1LCp1KmSPUEdgoo:OwxN2DFmSPQZPmzW
TLSH
T1C9039D28449A08011E27B93BDF296C158E9DE8F0B21F0567E625FC5E54A7B2C33F36D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc-pre-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-soc-pre-2008-03-31.xml
Size 50KB
SHA256 04cc4451e4d573d5a27f635ce3c7cf141d34916ba6d70653d565f6d56c86480f
MD5 f8fc9c92af73d6a50d0f9bc94700a468
SHA1 a437689c9feb3006a51547e96ef8c804a2d67a04
SHA512 0005382c6cb811c878c150d37c4deb61ac6a25d8e96936303ba8f15aa3c6a7c8d17f2a482286f6d0ac0f8e9db93973d60a23601a7a801c85b1eae3cd02b61a24
SSDEEP 192:Ow4Go1z1lHFhdAckmEWkPrbcuuvRd7UFRipFZgMJ91xqO6mumyvMIup597nN5dWM:OwZoDNSmmPzDf/y/t08
TLSH
T1D833B22C489758512F26B83ADF6D6C198E5DE8B0F21F0463F611FC1A54A3B6C37B3299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc1-cal-2008-03-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP1.0\XBRLUSGAAPTaxonomies-2008-03-31\stm\us-gaap-stm-re-soc1-cal-2008-03-31.xml
Size 2KB
SHA256 58814b9ada63eea34ede15ebcb464aad72f13c18fbe6b81711e8e5c42f82f74d
MD5 c97a41250e87077ed87658ccd625d1dc
SHA1 0b0d671695aa39f9b1eada9c1259d09b23a8d237
SHA512 d8c81c109463495cb14d3e2495f7643f560ee20128e0c42d3ec4498a415d3a83b5db8e7a77ca646da947dee84b8db34eb199043c2e52a99a7aa6706632910a5b
TLSH
T18D51815C44E648012E16B92AEF69AC1AC5C9B8B0725F0603E535FD1F60A773A33D3694
MD5 SHA1 SHA512 TLSH

Submit Download

us-gaap-doc-sic-def-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\non-gaap\us-gaap-doc-sic-def-2009-01-31.xml
Size 1KB
SHA256 81c65d835c9aa233150ed2637f913dad788af08e0648c78f258713b6e922ab6e
MD5 112760dfcf33ca427fbdbf52f6900ade
SHA1 8be1841012e27df0425dc7d70eb221ab4b329503
SHA512 63ad4ff873309f0aab8ba29e4697b9b6fe4ab8308e30a0d33d03af25173791f252dcfceeb5d62d3db98efc790cc6d2c9fb21ceb882b22af45c5cea2f24e61340
TLSH
T14C2127DC50A99470760CAD19F6EABD3CD012B9A0F6CA5642D1B1DEB4A127B78231232F
MD5 SHA1 SHA512 TLSH

Submit Download

us-gaap-stm-re-com-pre-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-com-pre-2009-01-31.xml
Size 23KB
SHA256 3e5c702fa7c7ec873c034f2c6bff52c1dd1c28f94b410a885d7cfade65279d1f
MD5 d15231d663cc3299e375c156d3a3a237
SHA1 60d87e6183124350d1a2b6701ea4e702960fbc93
SHA512 14f64dd18e9d58be02310a4de6360487d60c052203820b9d9917a20828265975192548170fffa922d1b271f60c117e4ddefcaa6c88681eff0fe807676d6bf069
SSDEEP 192:j9UGo0y4cUk2V6iIs/L8rUvivXrXmRjYgaZa4uO/tTW01k1G1v1w1t121SO7qZ3F:j9doEivreYrsW/k0E2NA7G11DLKl
TLSH
T130B2644C54D728006B5DF92AED68AD28E11D5DB2C25B0267E424FD2E9027F397BF3389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci-cal-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-sheci-cal-2009-01-31.xml
Size 51KB
SHA256 5a09362530fb4723bdd3c8e4d6891af2b1e9f83dec46854ccad8a357e83e3f41
MD5 e13859094a099ec02aff71577548d33b
SHA1 91d58667679975c847788bf702b70288c13a8bbf
SHA512 7412f38da678f032f9bbb10f79e61a7a99fd545d7c5f543e5a6e0b3e210d6ba86c00bcf953e668a094181d02918753b696eb7b945dadfa10f83a08de7a64708f
SSDEEP 384:j93odvO8ZrH7OBW/xZDexBr/bodzdJa8wAiHwQaQcGN50TkxyIWgx48H5UZLyY3Q:jZoI8V/xErgdZwjaQ7NHxkgxJKZLLQ
TLSH
T19F335B1C40E358024A6BB52ACE296C1DD6AD5CF5A62F1163D126FC2D80E7B3837F36D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci-pre-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-sheci-pre-2009-01-31.xml
Size 114KB
SHA256 7e7b806e08edb7b6be6d84b6ee1f5a1d63c338dcbd01e871d39566d0b92be6fb
MD5 bcb54009fe9aada7a1a242a08e189d99
SHA1 5f4084ac828dd93967a9913994a33b9bf7463a75
SHA512 609ca61239d8113070132d4c8db96880bba2093b02e5b20f67426ba4a9c8e72ddf60de6487f5b796854dd4915fe03279a6fc91535ee25273ad95adaf629dc854
SSDEEP 768:jtodmlWrfevwjdhafos8W/xjMAc0Bma9BRbAPaVN5m5Vhm86dtbSJMim+E8NgDAC:nlWrfevwWoM5NBRbAPaVN5KML
TLSH
T1EEB3BB1C54E728411F5AB83ADE796C1DD66D98B1E62F0163E126FC1D40A7B3C3BB3298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci2-cal-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-sheci2-cal-2009-01-31.xml
Size 32KB
SHA256 7896af18fa8a609c95c7a8002ceae9be5c09f4f15c01f416e40910954390f6e9
MD5 7136b092f3fe2f0dd2ad435ec5b1e1d9
SHA1 68e0c0680a731f064c1d88ba25a69e1f8398ea43
SHA512 d766ce184ca7e95eea38f37d5fad7f03a29722756110f52781628b93b94fb9c475fd02c4017d9704b1933e8d8ec6c160c6c525b64d53380999789ec11b64aa07
SSDEEP 192:j9jKirc7p6aTnTIjMxv+HF0dlcl5NUDWcvvmKP61KJo0mt0IttoQmTtQk6X/YEH6:j9jKirc7T82mKP5xmyI+N5v7
TLSH
T127E28D68449A18011E27B93ACF296C19CA9DECF1B21F0563E516FC6E50A7B2C33F36D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-sheci3-cal-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-sheci3-cal-2009-01-31.xml
Size 27KB
SHA256 e04a3236b75577292dcbc7a13a657a35488e8b3c32121d2529a177954ab2722b
MD5 c0e5ba29c86c4880eb1e7c7e7bef93f6
SHA1 53fe2585a6e3d679d37b5b27bcd7e9ff7fa94f93
SHA512 224d59db962ada05c9a0f0dba500283a79fd437b826e6cb8492b2f380989894296857438e2ab2a28cc31761da418bd576ffff10eeb57088059a432a8ebbbaae2
SSDEEP 192:j9Pxv+HF0dlcl5gm5PUEHyoyFfqaPUEd65kMbb2Jx09Dz7bqSWFSJKD5EjHW9ToV:j9x8cm5PYNZ3W
TLSH
T1D4C2AD28449A18011E27B936CF296C19CE9DECF1B31F0567E626FC5E50A7B2C33B3695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc-cal-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-soc-cal-2009-01-31.xml
Size 62KB
SHA256 b2a97e648bc754b7431e6cd24c35f26bd18014cc4d4fcccbe6fd6cc2f4b9924e
MD5 d1a2767b60a1998b2625bf1cbb2931ca
SHA1 d8d3c3a8e3d2ced6643743c901e8bfba7d98e4c7
SHA512 f6ac4e6a41d397e613521b0ea60dfa4e2b6f63e1275b965af0d1b415f92659478a74500aa19329067cdf624c14be78c13c11516a00f7bf03a8017f0b9486d37f
SSDEEP 192:j9vhaHF0dlcy6Cv1xgxUFvcdwypKbWbpi90n456EuTgvOM2pWZ6xlOs9XmumD9gK:j9mWGDYmbPFhN/Er
TLSH
T170539D38849618111E1BFA36CF196C19CE58E8B2B21F1463E616FC6E55B7B2C33B3794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc-pre-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-soc-pre-2009-01-31.xml
Size 95KB
SHA256 a0f9d48f6de2a98775efb988a89e90002413fdd8c5e3e7e8b4353cdd59d68ba1
MD5 a8072b7eb3790fd7d1e0686306230a00
SHA1 713db2e70ceb211c26a0864423c24aa2d19d7b21
SHA512 3efdcbd9f264b4514632881d0961810441553822356e7519085f4d32b284dcb107c4c24e529eff8f3defb8160549f32fb30b8dd85fa720689121ef5364143a67
SSDEEP 384:j9Yoy8MmxPqDXxuHVbA0OLi8BouYdBX63kkAHU6rzBT+eNksKQY/4b/BTNY:juoy8L8Bx
TLSH
T1AD93C13848A759111E1AF925DF2C7D198E58E8B2F21F0463F612FC1A54A7B2C37B7398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

us-gaap-stm-re-soc1-cal-2009-01-31.xml

Path C:\Program Files (x86)\Altova\Common2011\xbrl\US-GAAP2009\XBRLUSGAAPTaxonomies-2009-01-31\stm\us-gaap-stm-re-soc1-cal-2009-01-31.xml
Size 19KB
SHA256 5db3bc506ea4eb116f42d3dea06c49d72577f2cf5c290ebf01f8a2a025ab6bb1
MD5 ad28668aa3053ca7a9155cc5457e2feb
SHA1 6e1209e71e38685069ee6d5b4d5f58bf989ef420
SHA512 74ca6066bf4ff4d1475a6cca7d0ed322cbca7ebcab787993ccc9ad62ae748fff8a01ed1bc3597916e8a966468793cff31085e32d6f42e4950c0a16bd683b27b8
SSDEEP 192:j9ihAx15+HF0dlcykXQCv/qE45Ed65kYdtb5Edqe4EHyFUqfPayPE4PEh3K6AZ43:j9wWRhi
TLSH
T17A92903884AA18111E1ABA25DF18AD19CD58A872F11F1453E616FC3E50FBB3D33B3798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdAfx.cpp

Path C:\Program Files (x86)\Altova\MapForce2011\spl\cpp\LibraryDB\StdAfx.cpp
Size 436B
SHA256 88654ffbd9043672d6bfc2c34a77395965c7f9b3ae1408b62c0bfe7946c93104
MD5 11d36c70f742234cbfb4c3a3b7ceb02e
SHA1 102971ec8a1af69be15a69ac926d02bc6fad2b3d
SHA512 4f7b266142dec435857b8d9dc1ea93b2cc943f7e43675ecb081beb303118d273c04fa48d8df0e2bf56d319ce00918ee314182c6c48881de59ee2304b1f8004a4
TLSH
T1CCE02B8048C795F79B277522D92ADB51F65932CCC65722113882FBBB0131910078E8BB
MD5 SHA1 SHA512 TLSH

Submit Download

AssemblyInfo.cs

Path C:\Program Files (x86)\Altova\MapForce2011\spl\cs\LibraryDB\AssemblyInfo.cs
Size 2KB
SHA256 6db6f2607e7286fca18e87c47e129349c7efc51d2ede1fdb2dd27d8152345126
MD5 c53750c21080ba67c6e70ace0f3d6046
SHA1 9732dac9812bfc95a092bf5097948b92b7702222
SHA512 2c49d4477cdea04554be21273fe2978f738f87f0e709554caecaf8c734882f8f293b5b9bbdb89762949d971c7542c8eac001fde5d0a913965756ee1aa19634c2
TLSH
T1EE51E96B5749A33F2F520123BDAF6B96E71C53AD83C90005382CD56AE705A2427EB0DB
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC3D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC3D3.tmp
Size 583KB
SHA256 bd98dd2a3681eecfb94e803647d6dea7c7d8f9f1b745fb10c0c25d5676a24c75
MD5 792438b5ebca3c7e551df219df91c8e0
SHA1 b3ad9058bf001405f5037cc641ded5bc384d5833
SHA512 740b2383cde7072cf658583773b878a0e07f704aa6678dd884f95f5db48f05e4ce53dbaff4b141d9b94b70f645a62992b91945ffbbd0af71dea28fb85e62b5c5
SSDEEP 12288:J+XQuwH9Sm5PkZvjROt7SekoiLteaUjWijmU3nDIvgG:75wjROMLtTUjWijmAnDIo
TLSH
T185D47D1177D48075F1AE27B41979C23C98BAB9615F38DACFA3884A6F1E316C1AD34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Altova MapForce 2011 Enterprise Edition.msi

Path C:\Windows\Downloaded Installations\{BE84735E-053F-4517-886D-D9786522B7FA}\Altova MapForce 2011 Enterprise Edition.msi
Size 40.3MB
SHA256 9ad94fe79ee4fde10c4d03f0ff1ac2412d7db798874d09a99f366a9d63ed20ce
MD5 1a832adae657ba909699aa258ae081d3
SHA1 cc276d30ca1d9a31c371a9325609067b46383099
SHA512 96cb8cde5ccbd3dcbac2ed8619eaf456704d63eb1fd82603a5059c2adf5b35b13b4b148b7446072080f59e115f4c57d46156f9aed6ebd6bd655a7d1d1e2c2fa1
SSDEEP 786432:7fWU0EHt7sPsFPiNtCfn6xFdio4W5UjXGfUBorG7Yjr:jWU0YtAMPiKf6Hd8TGfUBorG7
TLSH
T17E9733237692005FF24565B8C2A7B3AD8D31FCB597314A96A5BFF11E3DB439422B0386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 46ead539a8804b44b5e047ab83f3f06de19dabe2a1ec0f60038c8eda4617ef5e
MD5 825a1d576a970147182dc37c9575eeec
SHA1 2b8f74a9c62c2c4f4a2e5428687dccdbb3ce5ac7
SHA512 5d4c93bab6a1d783c06624a4ba0939d2648c45da0cca9a6a59e77b26126e1e5c886f18a271b865720c2357d220837e3c8ef97c5d70e12f3d249bde95553aec80
SSDEEP 24576:aFo3DMPidoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:FHU
TLSH
T1B557B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ffe6a992-6739-4caf-af83-f6693ed2e26d}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ffe6a992-6739-4caf-af83-f6693ed2e26d}_OnDiskSnapshotProp
Size 6KB
SHA256 0f379ca593c65528cd52ecdf2842fd7297ada2bba6e9b9c8ea11a48ad22837ba
MD5 0767d5101372024ea4f14a4669829459
SHA1 310dfc44b5811875893f2604d6e886c064bd8867
SHA512 a86644b568890329aed65cd0fafd57a92a36d0cf536ed7d912f19aab47c9b869df2c2aa4a4e6aea46fc49f18fc1c2867ca1cea3b4bcd11a024a3f52fd5caf597
SSDEEP 96:Fgd67VCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:ydweb++uVmN
TLSH
T1FDD188085AF54711E2B3AB3129F58557A877B811EF33CB8E0198238E6631A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4576-70-0x0000000003080000-0x000000000311A000-memory.dmp

Download