3078c781785bbd2a01af7c2d26cbfb069b3650bfd87c8119721fc63c47c9d55a

Analysis

max time kernel
122s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
Size 4.5MB
Sample260808-bs75psxdmf
SHA256 3078c781785bbd2a01af7c2d26cbfb069b3650bfd87c8119721fc63c47c9d55a
MD5 4bd8d9c481afb2552c1547f8b9bac669
SHA1 60bbdbfe4812b317c2029b96f6e10a3496eb0b46
SHA512 fca4ee767c3b746eedc1864b31c744974f38a9d9ee96ff9d4d7baba7999dc9aa22d2215524617f94bb9021e1b4a9e4e6b595a4296cef2151b7f085388940a8b0
SSDEEP 98304:DfYgAuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuuuuuuuuuuuuuuuuuz:DfT4OFEtpxYEUW
TLSH
T100268D40B640C1A6EBE729F449AD7238A11CADB54B1591C7E1C8FBFEA7396F03D30256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4188	dat.exe
1824	svchost.exe
2024	dat.exe
5780	svchost.exe
4160	dat.exe
6172	2D32.tmp.exe
6560	smses.exe
6584	svchost.exe
6604	smses.exe
124	smses.exe
2360	5924.tmp.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05013_7 = "C:\\Windows\\smses.exe"	dat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05013_7 = "C:\\Windows\\smses.exe"	dat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05013_7 = "C:\\Windows\\smses.exe"	dat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\s:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\v:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\k:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\o:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\g:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\j:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\r:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\z:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\m:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\w:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\x:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\n:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\d:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\i:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\t:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\q:	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dat.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\smses.exe	svchost.exe
File opened for modification	C:\Windows\dat.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\smses.exe	dat.exe
File opened for modification	C:\Windows\smses.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\dat.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\smses.exe	svchost.exe
File opened for modification	C:\Windows\smses.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File created	C:\Windows\dat.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\dat.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
File created	C:\Windows\smses.exe	dat.exe
File opened for modification	C:\Windows\smses.exe	dat.exe
File created	C:\Windows\2D32.tmp.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\smses.exe	dat.exe
File opened for modification	C:\Windows\2D32.tmp.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5924.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D32.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smses.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smses.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5576	taskkill.exe
3692	taskkill.exe
3640	taskkill.exe
6748	taskkill.exe
1984	taskkill.exe
4508	taskkill.exe
2124	taskkill.exe
2184	taskkill.exe
5360	taskkill.exe
5908	taskkill.exe
1900	taskkill.exe
5476	taskkill.exe
3504	taskkill.exe
4152	taskkill.exe
2832	taskkill.exe
5260	taskkill.exe
444	taskkill.exe
6716	taskkill.exe
2608	taskkill.exe
5724	taskkill.exe
4800	taskkill.exe
1980	taskkill.exe
4688	taskkill.exe
2620	taskkill.exe
4876	taskkill.exe
2016	taskkill.exe
2484	taskkill.exe
3784	taskkill.exe
1140	taskkill.exe
1200	taskkill.exe
584	taskkill.exe
2976	taskkill.exe
1364	taskkill.exe
6864	taskkill.exe
2932	taskkill.exe
5140	taskkill.exe
6732	taskkill.exe
2564	taskkill.exe
6660	taskkill.exe
5456	taskkill.exe
3724	taskkill.exe
3600	taskkill.exe
6248	taskkill.exe
6684	taskkill.exe
6268	taskkill.exe
6056	taskkill.exe
480	taskkill.exe
5860	taskkill.exe
6688	taskkill.exe
6984	taskkill.exe
4640	taskkill.exe
1696	taskkill.exe
5352	taskkill.exe
6740	taskkill.exe
6216	taskkill.exe
2900	taskkill.exe
5948	taskkill.exe
1280	taskkill.exe
6028	taskkill.exe
4212	taskkill.exe
5868	taskkill.exe
2412	taskkill.exe
4104	taskkill.exe
716	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe
4188	dat.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
Token: SeShutdownPrivilege	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	5140	taskkill.exe
Token: SeDebugPrivilege	476	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	5576	taskkill.exe
Token: SeDebugPrivilege	1824	svchost.exe
Token: SeShutdownPrivilege	1824	svchost.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	3724	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	5824	taskkill.exe
Token: SeDebugPrivilege	5780	svchost.exe
Token: SeShutdownPrivilege	5780	svchost.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	1360	taskkill.exe
Token: SeDebugPrivilege	6560	smses.exe
Token: SeDebugPrivilege	6584	svchost.exe
Token: SeShutdownPrivilege	6584	svchost.exe
Token: SeDebugPrivilege	6676	taskkill.exe
Token: SeDebugPrivilege	6724	taskkill.exe
Token: SeDebugPrivilege	6732	taskkill.exe
Token: SeDebugPrivilege	6688	taskkill.exe
Token: SeDebugPrivilege	6756	taskkill.exe
Token: SeDebugPrivilege	6716	taskkill.exe
Token: SeDebugPrivilege	6764	taskkill.exe
Token: SeDebugPrivilege	6748	taskkill.exe
Token: SeDebugPrivilege	6740	taskkill.exe
Token: SeDebugPrivilege	6708	taskkill.exe
Token: SeDebugPrivilege	2608	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	6248	taskkill.exe
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	5504	taskkill.exe
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	7024	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 5868	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	89
PID 3060 wrote to memory of 4140	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	90
PID 3060 wrote to memory of 4900	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	91
PID 3060 wrote to memory of 5140	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	92
PID 3060 wrote to memory of 4800	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	93
PID 3060 wrote to memory of 480	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	94
PID 3060 wrote to memory of 4068	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	95
PID 3060 wrote to memory of 476	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	96
PID 3060 wrote to memory of 3784	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	98
PID 3060 wrote to memory of 5576	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	99
PID 3060 wrote to memory of 4188	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	97
PID 3060 wrote to memory of 2828	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	110
PID 3060 wrote to memory of 3808	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	111
PID 3060 wrote to memory of 5064	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	112
PID 3060 wrote to memory of 1116	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	113
PID 3060 wrote to memory of 3744	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	114
PID 3060 wrote to memory of 2148	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	115
PID 3060 wrote to memory of 5808	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	116
PID 3060 wrote to memory of 4332	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	117
PID 3060 wrote to memory of 6068	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	118
PID 3060 wrote to memory of 1724	3060	2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe	119
PID 1824 wrote to memory of 5824	1824	svchost.exe	134
PID 1824 wrote to memory of 2484	1824	svchost.exe	135
PID 1824 wrote to memory of 3724	1824	svchost.exe	136
PID 1824 wrote to memory of 5948	1824	svchost.exe	137
PID 1824 wrote to memory of 1980	1824	svchost.exe	138
PID 1824 wrote to memory of 5860	1824	svchost.exe	139
PID 1824 wrote to memory of 1900	1824	svchost.exe	140
PID 1824 wrote to memory of 5908	1824	svchost.exe	141
PID 1824 wrote to memory of 6056	1824	svchost.exe	142
PID 1824 wrote to memory of 3852	1824	svchost.exe	143
PID 1824 wrote to memory of 836	1824	svchost.exe	144
PID 1824 wrote to memory of 3896	1824	svchost.exe	145
PID 1824 wrote to memory of 1880	1824	svchost.exe	146
PID 1824 wrote to memory of 4360	1824	svchost.exe	147
PID 1824 wrote to memory of 2364	1824	svchost.exe	148
PID 1824 wrote to memory of 2652	1824	svchost.exe	149
PID 1824 wrote to memory of 4896	1824	svchost.exe	150
PID 1824 wrote to memory of 3764	1824	svchost.exe	151
PID 1824 wrote to memory of 3332	1824	svchost.exe	152
PID 1824 wrote to memory of 2712	1824	svchost.exe	153
PID 1824 wrote to memory of 2024	1824	svchost.exe	133
PID 1824 wrote to memory of 5780	1824	svchost.exe	174
PID 5780 wrote to memory of 4160	5780	svchost.exe	175
PID 5780 wrote to memory of 1140	5780	svchost.exe	176
PID 5780 wrote to memory of 1360	5780	svchost.exe	177
PID 5780 wrote to memory of 4340	5780	svchost.exe	178
PID 5780 wrote to memory of 5476	5780	svchost.exe	179
PID 5780 wrote to memory of 4212	5780	svchost.exe	180
PID 5780 wrote to memory of 2124	5780	svchost.exe	181
PID 5780 wrote to memory of 1820	5780	svchost.exe	182
PID 5780 wrote to memory of 4688	5780	svchost.exe	183
PID 5780 wrote to memory of 3600	5780	svchost.exe	184
PID 5780 wrote to memory of 3864	5780	svchost.exe	185
PID 5780 wrote to memory of 5256	5780	svchost.exe	186
PID 5780 wrote to memory of 5980	5780	svchost.exe	187
PID 5780 wrote to memory of 2284	5780	svchost.exe	188
PID 5780 wrote to memory of 788	5780	svchost.exe	189
PID 5780 wrote to memory of 5752	5780	svchost.exe	190
PID 5780 wrote to memory of 5928	5780	svchost.exe	191
PID 5780 wrote to memory of 4276	5780	svchost.exe	192
PID 5780 wrote to memory of 6032	5780	svchost.exe	193
PID 5780 wrote to memory of 1568	5780	svchost.exe	194
PID 5780 wrote to memory of 1768	5780	svchost.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4bd8d9c481afb2552c1547f8b9bac669_amadey_elex_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5140
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- C:\Windows\dat.exe
  "C:\\Windows\\dat.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:2828
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3808
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5064
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:1116
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3744
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:2148
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:5808
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4332
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6068
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6764
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6780
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6788
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6796
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:6804
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:6812
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6820
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6828
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6836
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    PID:6632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:6180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:6684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:124
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7052
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:928
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:7032
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6624
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:5352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    PID:7056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:5724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:4508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:6960
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:6956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6340
- C:\Users\Admin\AppData\Local\Temp\5924.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\5924.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:3320
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3820
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:684
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:4948
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:3100
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4156
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:2088
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6184
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:2472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  PID:2832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  PID:4148
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  PID:5356
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:5260
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:6216
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  PID:6268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2184
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6204
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6528
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:5960
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6568
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:6980
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:2176
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3884
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:5652
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7028

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\dat.exe
  "C:\\Windows\\dat.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:2024
- - C:\Windows\smses.exe
    "C:\Windows\smses.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:836
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3896
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:4360
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:2364
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:4896
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3764
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:3332
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\dat.exe
    "C:\\Windows\\dat.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:4160
  - - C:\Windows\smses.exe
      "C:\Windows\smses.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5980
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:788
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4276
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:1280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:2564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:4104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:6156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6152
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6236
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:5456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:2932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:1112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6920
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:6904
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6076
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6640
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1188
- C:\Windows\2D32.tmp.exe
  "C:\Windows\2D32.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:7024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  PID:3316
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  PID:6992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:6984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:6936
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:1736
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:7000
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5832
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:7108
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:6612
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:2348
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:6668
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  PID:6224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  PID:2960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  PID:2016
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  PID:4876
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  PID:5360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  PID:6596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  PID:5584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  PID:3404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  PID:6660
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:3024
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:4908
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:2324
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6200
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:6876
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:4580
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:6240
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3236
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:3472
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6540

C:\Windows\smses.exe
C:\Windows\smses.exe
1⤵
- Executes dropped EXE
PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.3MB
SHA256 23aa0d1295b0e3b98a98f297191d97dde760385ceb5375b4ce43eaa61a83eb6c
MD5 10fc8450785de0344871c6c2f7b601a9
SHA1 36914f46e4fa460462e7c062d412e3adad2b0e8b
SHA512 45135dd7da758808436534bc4ea400515a54c2bda92aa836e6d2ef9fcfaa3967497719487e5f66b5db1071a90618fb4a92790e8eff2829529c451b858efa6991
SSDEEP 49152:+WuAw8sdgN+uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuuuuuuuuuuu5:DfYgAuuuuuuuuuuuuuuuuuuuuuuuuuun
TLSH
T1ACB5C540B700D166EBEB29F48A9D6238A15CADF44B5491D7E0C87BFEAB396F03D30156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D32.tmp.exe

Path C:\Windows\2D32.tmp.exe
Size 2.2MB
SHA256 ffc3515997b0a2fa0a2f233fc6ccb7a22d4f6de878f43d70181b7c56ba35a176
MD5 b2b754f65576c073f876202a0b43c1b6
SHA1 49a9715beada91ed886e5e3b74a60b6a4a27c93e
SHA512 7b7f0892ef974ea57f2d2af7ff3a8e41aa1a98ee9f80c59839331f7bb2df13a7bc442d1cce31e1544ed3af20cb49445a13eb3e206c9415cc3f9b5de87ac8d10d
SSDEEP 49152:yxCjqFiPTkNghvVpuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuuuuud:y4jqF/NytpuuuuuuuuuuuuuuuuuuuuuT
TLSH
T124B50142E6C241FBFE95793090BF7376AA34AF0B8A25DB477390FE917A31250650B316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\IME\svchost.exe
Size 4.5MB
SHA256 3078c781785bbd2a01af7c2d26cbfb069b3650bfd87c8119721fc63c47c9d55a
MD5 4bd8d9c481afb2552c1547f8b9bac669
SHA1 60bbdbfe4812b317c2029b96f6e10a3496eb0b46
SHA512 fca4ee767c3b746eedc1864b31c744974f38a9d9ee96ff9d4d7baba7999dc9aa22d2215524617f94bb9021e1b4a9e4e6b595a4296cef2151b7f085388940a8b0
SSDEEP 98304:DfYgAuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuuuuuuuuuuuuuuuuuz:DfT4OFEtpxYEUW
TLSH
T100268D40B640C1A6EBE729F449AD7238A11CADB54B1591C7E1C8FBFEA7396F03D30256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dat.exe

Path C:\Windows\dat.exe
Size 115KB
SHA256 edb78038fabd64cc88ce4b2083c6a82172e980f2ad4d875653c1afb2cf70a705
MD5 50aea2ab11f2e892ebca6591b0cef6b0
SHA1 9cc45efbec2830a17a42580ee767e0d7838be98d
SHA512 3e8bede3c874dac83021ab486285a536b13c2bce88bb09618d445b640c4644966d8a513907f25bb9da583d306a9821f2efb5df8048d284f7f10099def975a099
SSDEEP 1536:kOV6DKNYpH/+Gs9HPEYh1VRqIClgFCI0VKL03JaNpUzfApE+OeD:D67d6thhTOJcpUzfApE+OeD
TLSH
T115B3F735E240C4F7E8A300B2ADEDA9F694E4B835478F01E773C5CB69156A3F5823895B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-49-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1824-34-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/1824-11-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/2024-16-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2024-35-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2360-53-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/3060-30-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3060-0-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3060-1-0x0000000000675000-0x0000000000677000-memory.dmp

Download

memory/4160-37-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4188-33-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4188-7-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5780-36-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/6172-29-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/6172-52-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/6560-50-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/6584-51-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/6604-48-0x0000000000400000-0x0000000000430000-memory.dmp

Download