floxif | 8525062f49af88810c8369d2ea49a5e1c955b03e32b3675633645d29305f5867

Analysis

max time kernel
102s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Size 2.5MB
Sample260809-g5amvshb74
SHA256 8525062f49af88810c8369d2ea49a5e1c955b03e32b3675633645d29305f5867
MD5 ee3e3214e487df95d489fc5fa55ac133
SHA1 f22e6db5d0662b05ea142594e05c28dbe73ad22f
SHA512 fbad4e798eddaa3ef67ef0a213e37157423c3a32e30a8d9401b60d8b9cafec639af327dbb998dc22873d66312d9254d500c514b6cd1305186e42846fee15623e
SSDEEP 49152:MFhjEYuXXxDpJe1U1js/8Jxls9kg3Uv/oACkPany9nvacwtYRHgUK713P1AK713v:gEYuXBDpJIU1jVJDsk0hACFny9vacwtP
TLSH
T1CFC59D4534009CA3C5121EF2B58DF178FA7D6CB41F6508CB9668BF1C6EB70829A37DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000700000001b83c-1.dat	floxif

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b83c-1.dat	UPX
behavioral2/memory/4900-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4900-33-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4900-49-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4900-86-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4900-110-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 46 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4568	powershell.exe
5440	powershell.exe
1832	powershell.exe
4084	powershell.exe
4264	powershell.exe
1228	powershell.exe
2024	powershell.exe
4768	powershell.exe
5524	powershell.exe
5964	powershell.exe
1712	powershell.exe
472	powershell.exe
480	powershell.exe
3284	powershell.exe
2868	powershell.exe
5428	powershell.exe
6124	powershell.exe
200	powershell.exe
2556	powershell.exe
3880	powershell.exe
2608	powershell.exe
6044	powershell.exe
996	powershell.exe
760	powershell.exe
1884	powershell.exe
5148	powershell.exe
4884	powershell.exe
3980	powershell.exe
4608	powershell.exe
1412	powershell.exe
3532	powershell.exe
2888	powershell.exe
5584	powershell.exe
3132	powershell.exe
1796	powershell.exe
1036	powershell.exe
1936	powershell.exe
2812	powershell.exe
1156	powershell.exe
980	powershell.exe
552	powershell.exe
4428	powershell.exe
5796	powershell.exe
4644	powershell.exe
5972	powershell.exe
2060	powershell.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000001b83c-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001b83c-1.dat	upx
behavioral2/memory/4900-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4900-33-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4900-49-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4900-86-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4900-110-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Exclude from Windows Defender\command	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Exclude from Windows Defender	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Exclude from Windows Defender\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe \"%1\""	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Exclude from Windows Defender\command	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Exclude from Windows Defender	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Exclude from Windows Defender\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe \"%1\""	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	powershell.exe
4884	powershell.exe
5796	powershell.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
5796	powershell.exe
4644	powershell.exe
4644	powershell.exe
3980	powershell.exe
3980	powershell.exe
1832	powershell.exe
1832	powershell.exe
1156	powershell.exe
1156	powershell.exe
980	powershell.exe
980	powershell.exe
6044	powershell.exe
6044	powershell.exe
6044	powershell.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
996	powershell.exe
996	powershell.exe
996	powershell.exe
1796	powershell.exe
1796	powershell.exe
1796	powershell.exe
5972	powershell.exe
5972	powershell.exe
5972	powershell.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
4084	powershell.exe
4084	powershell.exe
4084	powershell.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
6124	powershell.exe
6124	powershell.exe
6124	powershell.exe
760	powershell.exe
760	powershell.exe
760	powershell.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
1884	powershell.exe
1884	powershell.exe
1884	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
1036	powershell.exe
1036	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeIncreaseQuotaPrivilege	5796	powershell.exe
Token: SeSecurityPrivilege	5796	powershell.exe
Token: SeTakeOwnershipPrivilege	5796	powershell.exe
Token: SeLoadDriverPrivilege	5796	powershell.exe
Token: SeSystemProfilePrivilege	5796	powershell.exe
Token: SeSystemtimePrivilege	5796	powershell.exe
Token: SeProfSingleProcessPrivilege	5796	powershell.exe
Token: SeIncBasePriorityPrivilege	5796	powershell.exe
Token: SeCreatePagefilePrivilege	5796	powershell.exe
Token: SeBackupPrivilege	5796	powershell.exe
Token: SeRestorePrivilege	5796	powershell.exe
Token: SeShutdownPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeSystemEnvironmentPrivilege	5796	powershell.exe
Token: SeRemoteShutdownPrivilege	5796	powershell.exe
Token: SeUndockPrivilege	5796	powershell.exe
Token: SeManageVolumePrivilege	5796	powershell.exe
Token: 33	5796	powershell.exe
Token: 34	5796	powershell.exe
Token: 35	5796	powershell.exe
Token: 36	5796	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeIncreaseQuotaPrivilege	4644	powershell.exe
Token: SeSecurityPrivilege	4644	powershell.exe
Token: SeTakeOwnershipPrivilege	4644	powershell.exe
Token: SeLoadDriverPrivilege	4644	powershell.exe
Token: SeSystemProfilePrivilege	4644	powershell.exe
Token: SeSystemtimePrivilege	4644	powershell.exe
Token: SeProfSingleProcessPrivilege	4644	powershell.exe
Token: SeIncBasePriorityPrivilege	4644	powershell.exe
Token: SeCreatePagefilePrivilege	4644	powershell.exe
Token: SeBackupPrivilege	4644	powershell.exe
Token: SeRestorePrivilege	4644	powershell.exe
Token: SeShutdownPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeSystemEnvironmentPrivilege	4644	powershell.exe
Token: SeRemoteShutdownPrivilege	4644	powershell.exe
Token: SeUndockPrivilege	4644	powershell.exe
Token: SeManageVolumePrivilege	4644	powershell.exe
Token: 33	4644	powershell.exe
Token: 34	4644	powershell.exe
Token: 35	4644	powershell.exe
Token: 36	4644	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeIncreaseQuotaPrivilege	3980	powershell.exe
Token: SeSecurityPrivilege	3980	powershell.exe
Token: SeTakeOwnershipPrivilege	3980	powershell.exe
Token: SeLoadDriverPrivilege	3980	powershell.exe
Token: SeSystemProfilePrivilege	3980	powershell.exe
Token: SeSystemtimePrivilege	3980	powershell.exe
Token: SeProfSingleProcessPrivilege	3980	powershell.exe
Token: SeIncBasePriorityPrivilege	3980	powershell.exe
Token: SeCreatePagefilePrivilege	3980	powershell.exe
Token: SeBackupPrivilege	3980	powershell.exe
Token: SeRestorePrivilege	3980	powershell.exe
Token: SeShutdownPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeSystemEnvironmentPrivilege	3980	powershell.exe
Token: SeRemoteShutdownPrivilege	3980	powershell.exe
Token: SeUndockPrivilege	3980	powershell.exe
Token: SeManageVolumePrivilege	3980	powershell.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4884	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	89
PID 4900 wrote to memory of 5796	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	91
PID 4900 wrote to memory of 4644	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	93
PID 4900 wrote to memory of 3980	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	96
PID 4900 wrote to memory of 1832	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	98
PID 4900 wrote to memory of 1156	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	100
PID 4900 wrote to memory of 980	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	102
PID 4900 wrote to memory of 6044	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	104
PID 4900 wrote to memory of 996	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	106
PID 4900 wrote to memory of 1796	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	109
PID 4900 wrote to memory of 5972	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	111
PID 4900 wrote to memory of 2868	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	113
PID 4900 wrote to memory of 4084	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	115
PID 4900 wrote to memory of 5428	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	117
PID 4900 wrote to memory of 6124	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	119
PID 4900 wrote to memory of 760	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	121
PID 4900 wrote to memory of 4608	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	123
PID 4900 wrote to memory of 200	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	125
PID 4900 wrote to memory of 1884	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	127
PID 4900 wrote to memory of 2060	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	129
PID 4900 wrote to memory of 4264	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	131
PID 4900 wrote to memory of 1036	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	133
PID 4900 wrote to memory of 2556	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	135
PID 4900 wrote to memory of 3880	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	137
PID 4900 wrote to memory of 1712	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	139
PID 4900 wrote to memory of 472	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	141
PID 4900 wrote to memory of 1412	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	143
PID 4900 wrote to memory of 1936	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	145
PID 4900 wrote to memory of 1228	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	147
PID 4900 wrote to memory of 3532	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	149
PID 4900 wrote to memory of 480	4900	2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ee3e3214e487df95d489fc5fa55ac133_amadey_elex_floxif_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "exit 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).RealTimeProtectionEnabled) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring 0 -DisableBehaviorMonitoring 0 -DisableIOAVProtection 0 -DisableScriptScanning 0 -DisableBlockAtFirstSeen 0 -DisableArchiveScanning 0 -DisableEmailScanning 0 -DisableRemovableDriveScanning 0 -DisableScanningMappedNetworkDrives 0 -DisableScanningNetworkFiles 0 -MAPSReporting 1 -SubmitSamplesConsent 1 -HighThreatDefaultAction Block -ModerateThreatDefaultAction Quarantine -LowThreatDefaultAction Quarantine -SevereThreatDefaultAction Remove"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download