91753cefea41f924951a6d441179a0f97b902ae30b7b1fd04b601d266dba435e

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.4MB
Sample260824-evfp1scn91
SHA256 91753cefea41f924951a6d441179a0f97b902ae30b7b1fd04b601d266dba435e
MD5 99fa5f2d164059a10488023ae14e9011
SHA1 d663c021f57da410dd9cd7179cc3c2e6126e0976
SHA512 f532afb9a7599267433845515e419d084432bf64704e4bc073d2597b2171d4dd5728a22e1d36753033e595014da59a39c0e6cf8169127a3681710820f2ca217e
SSDEEP 49152:3dGXpiQSflJikQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQQQQQ1QQQQQQQQQQQQQv:sQfrpQQQQQQQQQQ+QQQQQQQQQQQQQQlI
TLSH
T1EBB5EA20A7209125DFBFD5B90AAE612D541CED901F4765EBC0FC66EF9B686E03D3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3236	base.sfx.part01.exe
5992	base.exe
5260	svchost.exe
5480	svchost.exe
5140	base.exe
4824	svchost.exe
2388	base.exe
3640	base.exe
1580	snotes.exe
7140	snotes.exe
6784	snotes.exe
4760	snotes.exe
4640	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\r:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\z:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\g:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\o:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\d:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\m:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\n:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\u:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\h:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\u:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\y:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\k:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\q:	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\svchost.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\FB21.tmp.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\base.sfx.part04.rar	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240777125	base.sfx.part01.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\base.sfx.part02.rar	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\storage.dll	snotes.exe
File created	C:\Windows\base.sfx.part01.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part03.rar	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\FB21.tmp.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.sfx.part01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
6552	taskkill.exe
4584	taskkill.exe
1552	taskkill.exe
1292	taskkill.exe
4088	taskkill.exe
5284	taskkill.exe
2940	taskkill.exe
2936	taskkill.exe
2380	taskkill.exe
600	taskkill.exe
4756	taskkill.exe
6320	taskkill.exe
1476	taskkill.exe
2016	taskkill.exe
5244	taskkill.exe
3956	taskkill.exe
3152	taskkill.exe
428	taskkill.exe
6676	taskkill.exe
6204	taskkill.exe
2260	taskkill.exe
1780	taskkill.exe
3404	taskkill.exe
3572	taskkill.exe
2164	taskkill.exe
3372	taskkill.exe
6704	taskkill.exe
2616	taskkill.exe
1076	taskkill.exe
2484	taskkill.exe
6668	taskkill.exe
3096	taskkill.exe
4360	taskkill.exe
5816	taskkill.exe
6836	taskkill.exe
5768	taskkill.exe
3136	taskkill.exe
5864	taskkill.exe
3660	taskkill.exe
1704	taskkill.exe
6200	taskkill.exe
4068	taskkill.exe
3488	taskkill.exe
1860	taskkill.exe
4176	taskkill.exe
6820	taskkill.exe
3564	taskkill.exe
3904	taskkill.exe
3040	taskkill.exe
6828	taskkill.exe
1864	taskkill.exe
3588	taskkill.exe
4528	taskkill.exe
3988	taskkill.exe
6104	taskkill.exe
5536	taskkill.exe
5760	taskkill.exe
5044	taskkill.exe
1692	taskkill.exe
4456	taskkill.exe
4704	taskkill.exe
2860	taskkill.exe
6684	taskkill.exe
2316	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	snotes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	snotes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
5992	base.exe
5992	base.exe
5260	svchost.exe
5260	svchost.exe
5260	svchost.exe
5260	svchost.exe
5260	svchost.exe
5260	svchost.exe
5140	base.exe
5140	base.exe
4824	svchost.exe
4824	svchost.exe
4824	svchost.exe
4824	svchost.exe
4824	svchost.exe
4824	svchost.exe
5480	svchost.exe
5480	svchost.exe
5480	svchost.exe
5480	svchost.exe
5480	svchost.exe
2388	base.exe
2388	base.exe
5480	svchost.exe
3640	base.exe
3640	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe
5992	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	600	taskkill.exe
Token: SeDebugPrivilege	5760	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	2380	taskkill.exe
Token: SeDebugPrivilege	3136	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	5260	svchost.exe
Token: SeShutdownPrivilege	5260	svchost.exe
Token: SeDebugPrivilege	4824	svchost.exe
Token: SeShutdownPrivilege	4824	svchost.exe
Token: SeDebugPrivilege	5480	svchost.exe
Token: SeShutdownPrivilege	5480	svchost.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	4360	taskkill.exe
Token: SeDebugPrivilege	5816	taskkill.exe
Token: SeDebugPrivilege	5536	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	5252	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	5284	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5496	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	4824	svchost.exe
Token: SeDebugPrivilege	5480	svchost.exe
Token: SeDebugPrivilege	7140	snotes.exe
Token: SeDebugPrivilege	1580	snotes.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	6976	taskkill.exe
Token: SeDebugPrivilege	6836	taskkill.exe
Token: SeDebugPrivilege	6676	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	6200	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe
Token: SeDebugPrivilege	6828	taskkill.exe
Token: SeDebugPrivilege	6668	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3588	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 4952 wrote to memory of 1480	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4952 wrote to memory of 600	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4952 wrote to memory of 3236	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 4952 wrote to memory of 2380	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4952 wrote to memory of 5760	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 4952 wrote to memory of 3136	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 4952 wrote to memory of 3988	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 4952 wrote to memory of 4528	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 4952 wrote to memory of 4584	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 4952 wrote to memory of 1860	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4952 wrote to memory of 5336	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	109
PID 4952 wrote to memory of 2640	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	110
PID 4952 wrote to memory of 4468	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	111
PID 4952 wrote to memory of 4876	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	112
PID 4952 wrote to memory of 5744	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	113
PID 4952 wrote to memory of 1168	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	114
PID 4952 wrote to memory of 2948	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	115
PID 4952 wrote to memory of 1176	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	116
PID 4952 wrote to memory of 2936	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	117
PID 4952 wrote to memory of 4228	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	118
PID 4952 wrote to memory of 5992	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	131
PID 4952 wrote to memory of 5480	4952	2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	133
PID 5260 wrote to memory of 2484	5260	svchost.exe	135
PID 5260 wrote to memory of 3152	5260	svchost.exe	136
PID 5260 wrote to memory of 1704	5260	svchost.exe	137
PID 5260 wrote to memory of 5816	5260	svchost.exe	138
PID 5260 wrote to memory of 3040	5260	svchost.exe	139
PID 5260 wrote to memory of 4360	5260	svchost.exe	140
PID 5260 wrote to memory of 1076	5260	svchost.exe	141
PID 5260 wrote to memory of 1132	5260	svchost.exe	142
PID 5260 wrote to memory of 5536	5260	svchost.exe	143
PID 5260 wrote to memory of 3956	5260	svchost.exe	144
PID 5260 wrote to memory of 1736	5260	svchost.exe	258
PID 5260 wrote to memory of 2356	5260	svchost.exe	146
PID 5260 wrote to memory of 1700	5260	svchost.exe	147
PID 5260 wrote to memory of 3948	5260	svchost.exe	148
PID 5260 wrote to memory of 1908	5260	svchost.exe	149
PID 5260 wrote to memory of 1148	5260	svchost.exe	150
PID 5260 wrote to memory of 3240	5260	svchost.exe	151
PID 5260 wrote to memory of 3932	5260	svchost.exe	152
PID 5260 wrote to memory of 1708	5260	svchost.exe	153
PID 5260 wrote to memory of 1976	5260	svchost.exe	154
PID 5260 wrote to memory of 5140	5260	svchost.exe	134
PID 5260 wrote to memory of 4824	5260	svchost.exe	155
PID 5480 wrote to memory of 2388	5480	svchost.exe	176
PID 4824 wrote to memory of 1404	4824	svchost.exe	177
PID 4824 wrote to memory of 6104	4824	svchost.exe	178
PID 4824 wrote to memory of 3660	4824	svchost.exe	179
PID 4824 wrote to memory of 5244	4824	svchost.exe	180
PID 4824 wrote to memory of 5252	4824	svchost.exe	181
PID 4824 wrote to memory of 5284	4824	svchost.exe	182
PID 4824 wrote to memory of 4088	4824	svchost.exe	183
PID 4824 wrote to memory of 3904	4824	svchost.exe	184
PID 4824 wrote to memory of 5496	4824	svchost.exe	185
PID 4824 wrote to memory of 5092	4824	svchost.exe	186
PID 4824 wrote to memory of 2308	4824	svchost.exe	187
PID 4824 wrote to memory of 4452	4824	svchost.exe	188
PID 4824 wrote to memory of 3640	4824	svchost.exe	189
PID 4824 wrote to memory of 6072	4824	svchost.exe	190
PID 4824 wrote to memory of 4672	4824	svchost.exe	191
PID 4824 wrote to memory of 4120	4824	svchost.exe	192
PID 4824 wrote to memory of 1584	4824	svchost.exe	193
PID 4824 wrote to memory of 5644	4824	svchost.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_99fa5f2d164059a10488023ae14e9011_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:5336
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:2640
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:4468
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1168
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:2948
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:1176
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:2936
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    PID:4760
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2388
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:7140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    PID:4176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:6820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6320
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1428
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:6204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:6004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:2316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:6684
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6476
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6312
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6924
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5140
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:1700
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:3948
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:1908
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:1148
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:3240
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:3932
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:1708
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:6104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4452
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6784
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1584
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5644
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6200
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6488
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3152
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6352
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6076
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:6512
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:3096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:6308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:6704
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3560
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6196
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6324
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6336
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:1168

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1736

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D32.tmp~.exe

Path C:\Users\Admin\AppData\Local\Temp\D32.tmp~.exe
Size 5.2MB
SHA256 9d4d70488c54417135565de1ef8f4ed74fcdee8c5231e2277730a2080efad43d
MD5 c8d25a89b09f8f51882c8708fdadb389
SHA1 4bdc378525342d325d4dcfc89e10e2c280cbdbce
SHA512 d85cab628aed3a2529e937a5a6aba769fbce05b67d5cd5cfb6714368e4bddabd83ba0a6e54bd5a62d5783f78ef01b8995dfbf4bb064a14ca6e5073167c992cd1
SSDEEP 98304:sQfrpQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQQQQQ1QQQQQQQQQQQQQQQQQ1HQfH:sQfrpQQQQQQQQQQ+QQQQQQQQQQQQQQl3
TLSH
T123460B20A7209125DFBFD5B90AAE612D541CED901F4765EBC0FC66EF9B686E03D3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.4MB
SHA256 f2f0d2062eb1a181e1669456f077ef4e913750cb5b2a97c3c7668afedcaa6961
MD5 a0d3d8b16b1835ba07548cfdd7a11b20
SHA1 0d7f3f945c06ee483bdfc6dedb85d07c4b36e72f
SHA512 08ce9155b04c8b979b404b28f2a1fb9dda942d56892eb64fbc9c420a85fab9c44a05887cc914071bac60f65718f1df4f039ecbfed5980a810c2213ba7eb2bae0
SSDEEP 49152:3dGXpiQSflJikQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQQQQQ1QQQQQQQQQQQQQE:sQfrpQQQQQQQQQQ+QQQQQQQQQQQQQQlz
TLSH
T1B2B5EA20A7209125DFBFD5B90AAE612D541CED901F4765EBC0FC66EF9B686E03D3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FB21.tmp.exe

Path C:\Windows\FB21.tmp.exe
Size 16B
SHA256 5e72e432fc0434e7e2e28def4a7b16349f681d6552e3196919030dbc75c2f358
MD5 1ffe8a09c6ec89cc002487ee7bdc3884
SHA1 06978ebdc40d9b965822384bd3184c3294a2aebd
SHA512 a870dfbc1f83ea4e697b67aee4f15893a873a2ad7bf62b152ba3cb848eed6ef5a1ee1791192b99a03ddf20dcf4df6f034e8b6c63516ed683f5a7207edf214c4b
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Windows\IME\svchost.exe
Size 2.4MB
SHA256 91753cefea41f924951a6d441179a0f97b902ae30b7b1fd04b601d266dba435e
MD5 99fa5f2d164059a10488023ae14e9011
SHA1 d663c021f57da410dd9cd7179cc3c2e6126e0976
SHA512 f532afb9a7599267433845515e419d084432bf64704e4bc073d2597b2171d4dd5728a22e1d36753033e595014da59a39c0e6cf8169127a3681710820f2ca217e
SSDEEP 49152:3dGXpiQSflJikQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQQQQQ1QQQQQQQQQQQQQv:sQfrpQQQQQQQQQQ+QQQQQQQQQQQQQQlI
TLSH
T1EBB5EA20A7209125DFBFD5B90AAE612D541CED901F4765EBC0FC66EF9B686E03D3018E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 62.6MB
SHA256 e6c7cad4be06b8152d7c481f772ae2619c85c22b3b0f68380d5dcf8742fce6db
MD5 bc986e88590fd00f554e97efc73efc64
SHA1 c407679c9d82d8c81e4fb7aca7759d159555f7d0
SHA512 5d99e63cc98fadeb92579faa039dd9f244f0ca04bf608f5ef637c35687f42661f8bb2974bd635a5c69551825d02c1cd616a1adef1b73038a2bf7df64a586c480
SSDEEP 98304:3/JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJe:0
TLSH
T1C8E7F108A35E28F0C2907BF5B347DCC87066FA793BD485EE2DAC9E1128D44DA3569D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 62.6MB
SHA256 44efbea53be601849809762405cac1ec5ddbd00426ab6b2772ee8c5d9e3a13a3
MD5 804bc36bc6da1e387e981c6e311aad0e
SHA1 e7fe73038b179df5fd4f70e3db4707a3926e8c36
SHA512 daeb60b4c591e7d86e1344e8e8899427a2c38c00d5146322104488a633cd051a3b974c4a41b396d1ee678c93665b61256436cb28b86dadcb91748f25d858745c
SSDEEP 98304:3/JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJe:0
TLSH
T1CAE7F108A35E28F0C2907BF5B347DCC87066FA793BD485EE2DAC9E1128D44DA3569D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 62.6MB
SHA256 a54072522eaef166b40b18a30c69a89c09071acdedd3660050a6d05f1185afbe
MD5 14bc251142ae10309277cac6531be764
SHA1 ed578c5fbb3350ced778e90577241c2132efde88
SHA512 d28dadcf4a9191a41a36f06914d6024180d8155199c86bd59143af4548f367cef1fc558f51a473719643eb3505fdec5d2d10d123907fff3ef43e0c5224068bb6
SSDEEP 98304:3WJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJe:d
TLSH
T1B5E7F108A35E28F0C2907BF57347DCC86066FAB93BD489EE2DAC9E115CD44DA3169D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 62.6MB
SHA256 e0c2518abe2fa8dec991a3d100b1d7c826f474e71a4cc869aeeadeb9ace28b2f
MD5 71558f126418e88b68d12a5578263ca7
SHA1 ac4512abee2303f5127b21eff2a8f9d6b1a438d4
SHA512 50fafe739d9d9decdee5c286c062b48a6bf11fd2a6e19661a0e860f052ce9cc343a148465ddabf9a687b23ac7f6fc6d4da0d0ad8a90861ba4764acbbd107a8ed
SSDEEP 98304:3sJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJe:z
TLSH
T15EE7F108A35E28F0C2907BF5B347DCC87066FA793BD485EE2DAC9E1128D44DA3569D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.dll

Path C:\Windows\storage.dll
Size 47KB
SHA256 84ae115b54d40fa9a2d9f017d00ede28b9eb43ec25248e0b6be9f639968fedae
MD5 b5223380d51c26a5421ac9746a72841b
SHA1 6ad5cccbc5d1efd7072676c4a8882429fa0f0e2a
SHA512 89a3c3fb8ec5f29aaac355dd93e831da1fe4e7e2d2c071e8131187af60284e4aa33c783cbbe014e389a17168d2b3641fc5a578ac30956c0ad54fe51bfcc039ce
SSDEEP 768:n4cG8J7QLG2RaK+KfoDZnpFFZQc6/EZZZE+2S+Ay3E3GEV4qV8Z9TjuvhCknmap7:n4cG8GLG2QlowZpFFZQc6/MZZEay3Ngd
TLSH
T1FB237EAE7B94342687D21575C4BFBB0AEA7D09535848C8D4F09DC88C3EBB6EE4167603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1580-90-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2388-80-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2388-48-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3640-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3640-81-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4640-87-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4760-89-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4824-42-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/4824-78-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/4952-53-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/4952-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/5140-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5140-79-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5260-39-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/5480-77-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/5992-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5992-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6784-88-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/7140-91-0x0000000000400000-0x0000000000431000-memory.dmp

Download