Overview

overview

10

Static

static

10

2026-04-23...ar.exe

windows10-2004-x64

9

2026-04-23...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/04/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe
  • Size 7.1MB
  • Sample260423-wtbs4sdt2j
  • SHA256 f327075338a7b69c7308ec24575a86a554e772081c3f9854c4a55acc0545bf5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 11 IoCs
  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\USBMonitorSrv.exe
      /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3620
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2412
    • C:\Users\Admin\AppData\Local\Temp\host.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3632
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1500
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1288
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3240
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3644
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3204
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4916
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4200
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3504
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1064
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3988
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4104
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3828
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2000
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1060
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4120
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3904
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4028
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3564
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4188
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4344
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2672
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2716
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4352
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1720
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2604
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3756
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3908
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4876
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4656
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3708
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4844
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3992
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4296
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1228
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1316
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4384
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1012
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3508
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3696
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3164
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1248
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2172
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-23_441a9b33be74d07bdc1141957936c7e8_amadey_elex_glassworm_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2760
  • C:\USBMonitorSrv.exe
    C:\USBMonitorSrv.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\yyzUSB.exe
      "C:\yyzUSB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1212
      • C:\Windows\SysWOW64\host.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:1876
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:5044
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:3692

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Daemon.exe
        • Path C:\Daemon.exe
        • Size 454KB
        • SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 2.0MB
        • SHA256 02b56d7f06ea97e4a3b593f17bac0e7c4c59cf41455c696926b15586614e71a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 2.1MB
        • SHA256 dfc1d840d7bac7b5dc7464f0c2b6e4b0942c66307c6a3f479be1c3f4870c305a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.0MB
        • SHA256 13cccc252dd6fe92b547fc44d9089b09f8a37db98133fc47f9163ef212b1642e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.7MB
        • SHA256 5b110b8395e9321f7c483051ee0fc560b5b966f8d3acd2b231cf6ce206589011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.2MB
        • SHA256 ccbcee141e9ffcf897dedcb06f186d264d8d881e193ba08a62386c23869cb07e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.0MB
        • SHA256 29e6a05767887c4afc2cc6150b22f58e25103ff17ed003ce6944388e03dabad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.4MB
        • SHA256 84529d9fc2b66f8a9e8994cc50a0b4368dd1650318fa7d220169953676d4e372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 2.0MB
        • SHA256 1484a5b49b6d2065be22ee27555cb392a128d80e80ade71c2eb92d1427f58941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 2.1MB
        • SHA256 dc48222e008193f084597da6ac989e8d38f1caef8a89f984fcc0ac3f22f26423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 2.1MB
        • SHA256 722ab376afe6428ecd4530172ff92b8c6abe135d0a9a834d3007021219db0652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 2.2MB
        • SHA256 289b509dab939619c71db8c0bba808a5fb3852c07c62f2ed10841911b249bcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 8.6MB
        • SHA256 06ddbb6b912a321ffa6814acecfca345202d3ecb6371c79eec381800a2f68a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEContentService.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 2.4MB
        • SHA256 70c2624b94fdc8d527d6662b89e906cda90fb2c2d87ef4b1d145abf5249a3162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOHTMED.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE
        • Size 2.5MB
        • SHA256 eb8019af91818767c30f784f0acc4729b791df66fc410303416c29f59857ab9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NAMECONTROLSERVER.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
        • Size 2.1MB
        • SHA256 10c898d313e664c9fd715c679ab4bc0f2f5174c9a2056609a8078eb24fa4b718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ONENOTEM.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
        • Size 2.1MB
        • SHA256 afe7d0368f058597ac937056b48320d79f97cd08875e38d917318088c025a363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        POWERPNT.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
        • Size 3.7MB
        • SHA256 ad05e274366c6993a8a3f521f38b81cf18ff020bdf94c858a792950148852555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WINWORD.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
        • Size 3.8MB
        • SHA256 8f15bf170d6a56eb28db9b7a03a26b294e6a86208080c8316978883bed9ff249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoasb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 2.3MB
        • SHA256 3ecf3d97bd566f32b2bb70cf6433d27eede372dfdd3fa3c3306d8e00b07a2621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        officeappguardwin32.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 2.5MB
        • SHA256 17c1e9854f07a742583e8c6242ba84a5bf39c495a92c8d4e76506625e03b09dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        protocolhandler.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
        • Size 8.2MB
        • SHA256 00881d6c06cfd40e23970cfb0d08089ec9af59fdb0ae69c5efd507335b0ae153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FLTLDR.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
        • Size 2.5MB
        • SHA256 aac376ed67516b67a1395db0daaf4eea822254a65e04582fb1933d229a3d8bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOXMLED.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
        • Size 2.2MB
        • SHA256 0657d8f1c1c90db8f15f29b324944f3879cc53c3b60d05901b9785967631ac4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE
        • Size 2.2MB
        • SHA256 188646b248973e7b25311337aecd19aa9b5df43d90dc590860e711719f248e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOHTMED.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE
        • Size 2.4MB
        • SHA256 e73fbf009837df5fffb664258a6b3cd4178796104bffb124d45cf423808c7656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 2.2MB
        • SHA256 9cacd17ced81bbb1964477b0abc3fb14b7e7052cf70d9fba3aef5e8059906077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 7.1MB
        • SHA256 4b35542761425d9d1e6fc6bc6862c8e324a48f8eb8f68417421c7af0d9d799f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice_installer.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
        • Size 7.1MB
        • SHA256 82884997198aba9816dac1b9613b4ca9b5ae086e4f93eff8edcaf2195df2c4c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.exe
        • Path C:\Program Files\Mozilla Firefox\updater.exe
        • Size 2.4MB
        • SHA256 a0a8191f92b4ed92d1f797e11a0010639f8e63c61de5782c237574421e46f5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc.exe
        • Size 2.9MB
        • SHA256 f1d10f65b458b158f1ddb90c21c6024f7d1689f35979f00f854c4c7969b5f2e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.0MB
        • SHA256 3de90a5dcc37714f5dba12d362363564d171821c944658a1c8db3e120785d351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USBMonitorSrv.exe
        • Path C:\USBMonitorSrv.exe
        • Size 694KB
        • SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX712C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX712C.tmp
        • Size 4.9MB
        • SHA256 226afa300157cabdf5e2809e0bac3b43ffa639d0e011713927cea57905a8c3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX75A3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX75A3.tmp
        • Size 2.4MB
        • SHA256 e485b3103e0a0ccea2a018ed1b5787c15e18329b669d35366d4de601dc871ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7834.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX7834.tmp
        • Size 2.2MB
        • SHA256 aadba417cefe176203d6ee543bf1c917a55301290a351a710ea88405ea07848c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX8B94.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX8B94.tmp
        • Size 2.0MB
        • SHA256 fabec6ae2cb9bc2eaa75484e3f09dd252a863e925d0c2f1219b362ccb3431afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX920F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX920F.tmp
        • Size 2.0MB
        • SHA256 e8e5b88faa0545c1c6c2850eab89530e775785b773526cd34d29a5d28e19795f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX9F64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX9F64.tmp
        • Size 2.3MB
        • SHA256 19c657a9e46a28955ef49898f65e9026b35dcb6b9502df1397b3382cef938b86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXA85E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXA85E.tmp
        • Size 9.1MB
        • SHA256 5a348efc1ade371731508bdac8f05f6d90e7dfc72114f9a4afa393a41332eea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXAAC3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXAAC3.tmp
        • Size 2.3MB
        • SHA256 3cb48ca7f79ef46e4953a3aff193f5a2138af4878c36d1d4e9ec4fe4c8f0d772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXB650.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXB650.tmp
        • Size 3.3MB
        • SHA256 48591c3a3b81409e964843120f8f2df7b83981b1f9dca4bb30c72f37ffd4a837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXBD58.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXBD58.tmp
        • Size 2.2MB
        • SHA256 82d18937efe2779a04487d66995fbc5d846a2a26a3c054e47b4cb39360fe3390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXD530.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXD530.tmp
        • Size 2.5MB
        • SHA256 ea57dc2cdd890ed18615ba9ae4ddfb990bddc13ad00fe0de1cf46206315d72cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXE3E7.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXE3E7.tmp
        • Size 2.3MB
        • SHA256 2cd89cc4885719c1858b98c624e2f2769a890ef8bf5be400d3634c8a3184842f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 7.1MB
        • SHA256 f327075338a7b69c7308ec24575a86a554e772081c3f9854c4a55acc0545bf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 241bde346b1081ddebc8e633d691a2c25c4103f1fa3d6448a1193690c2b93248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 72456117c11adf7a78e6b4b0c0eda68d8ccba8525a0768daf70431794448a071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 2f6e61a31e10818892eea9d26bc2bdb00404e9ff8e0068756a7d8ec9561d74bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.1MB
        • SHA256 af66a96a53da8e755e34a515022c933dd6258e3e272854e96ed31932c7e23712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 6.5MB
        • SHA256 6ff42bfb8c95310c02ac249e6f57086d06f8176c0376cb321fe8ae052d18ccc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 f731e43d21511d7d26e6b7bf37561a8440b0b19776011da93a7c4c22889fce72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 3.0MB
        • SHA256 245d091ae6a58fc1d7efdd34df2f3d7f37f5ded90a7b4d1d9bbd71bff3979e34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 5844122e210859fa35e17a91660c184514d0400d4c9f64a07668810921eed2f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 0de2dae1c0b6ca0d704519f026d9b0303de3e123ac04bf0cf55fe3420d33b4f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.4MB
        • SHA256 5176e10e40663c8010c740f98ed580774e77603a770e966e75ac4f17be35baa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 73384aa163c593ddf3d6db646d01453e90fe7c5470abc84a90029d1bb1fdc338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 d2dcdc9f1cb390e824d485e1df323401aeb79d154d621629e8667757d503385e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX46D5.tmp
        • Path C:\Windows\SysWOW64\RCX46D5.tmp
        • Size 2.5MB
        • SHA256 81288cc3ceafbff72a82fda49da026b0f38a535c301f7a05d1e76dbbc7793ea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX6FE8.tmp
        • Path C:\Windows\SysWOW64\RCX6FE8.tmp
        • Size 2.0MB
        • SHA256 0b3e981a24f3d498580bb2a468a18f9c08d9a271fa7a810df6c76abe2e08cfb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX8B67.tmp
        • Path C:\Windows\SysWOW64\RCX8B67.tmp
        • Size 2.2MB
        • SHA256 71cb76aa059baa4b855b3714e869500ea750b413fffbbf18ace3ab64b5ea4d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXCD31.tmp
        • Path C:\Windows\SysWOW64\RCXCD31.tmp
        • Size 2.1MB
        • SHA256 86d34b7b164310ab885b98be8cd512ba89ce6e98d91da2bb062d42cc7b912a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXDEBD.tmp
        • Path C:\Windows\SysWOW64\RCXDEBD.tmp
        • Size 6.1MB
        • SHA256 21a5a73587b1d5b89dd8dfdcdff06404e7140ecc3d444f3408769220e9960df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXFFF8.tmp
        • Path C:\Windows\SysWOW64\RCXFFF8.tmp
        • Size 2.4MB
        • SHA256 d549cdcf659e69a5b9a3eda788e2b5f007171b0441f28dd9e85a3eb5b245dd4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host.exe
        • Path C:\Windows\SysWOW64\host.exe
        • Size 5.2MB
        • SHA256 5acec5596e3b172c93d78d07054f5ad3fa40480ad89832265d844fbd31013c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.1MB
        • SHA256 9140ce38e7023c5466a6190588b3af9f401d76163094b9349b2a6f1ccc22439e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.3MB
        • SHA256 3bff4e836b55dbbad8888ca67fd5f0736044e1735086e4a1540997d743b5f6dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 3.1MB
        • SHA256 5372aa5dca780e978bd25226ff83ccbe8f756f3d086c3a114450eb40e9db8fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        service.log
        • Path C:\service.log
        • Size 429B
        • SHA256 73014d934433e497785818294c97542b6d790b777d60b95de188883038c67b15
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1012-120-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1060-102-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1064-98-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1108-146-0x00000000000A0000-0x0000000000196000-memory.dmp
        Download

        memory/1108-305-0x00000000000A0000-0x0000000000196000-memory.dmp
        Download

        memory/1212-175-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1228-131-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1248-135-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1288-67-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1316-118-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1500-66-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1600-108-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/1720-125-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2000-109-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2084-364-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2084-823-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2084-592-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2084-14-0x0000000000710000-0x0000000000E82000-memory.dmp
        Download

        memory/2084-534-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2084-243-0x0000000000710000-0x0000000000E82000-memory.dmp
        Download

        memory/2084-137-0x0000000000710000-0x0000000000E82000-memory.dmp
        Download

        memory/2084-533-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2084-266-0x0000000000710000-0x0000000000E82000-memory.dmp
        Download

        memory/2084-322-0x0000000003B20000-0x0000000003B27000-memory.dmp
        Download

        memory/2084-363-0x0000000007110000-0x0000000007882000-memory.dmp
        Download

        memory/2172-122-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2412-138-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2412-64-0x00000000008B8000-0x00000000008B9000-memory.dmp
        Download

        memory/2604-115-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2672-112-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2716-113-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/2760-136-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3164-134-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3204-106-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3240-69-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3504-107-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3508-133-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3564-110-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3620-63-0x00000000000A0000-0x0000000000196000-memory.dmp
        Download

        memory/3620-168-0x00000000000A0000-0x0000000000196000-memory.dmp
        Download

        memory/3644-71-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3692-177-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3696-121-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3708-129-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3756-126-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3828-101-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3904-104-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3908-116-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3988-99-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/3992-117-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4028-105-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4104-100-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4120-103-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4188-114-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4200-97-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4296-119-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4344-111-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4352-124-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4384-132-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4656-128-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4716-310-0x0000000000850000-0x0000000000FC2000-memory.dmp
        Download

        memory/4716-211-0x0000000003E00000-0x0000000004572000-memory.dmp
        Download

        memory/4716-350-0x0000000003DE0000-0x0000000003DE7000-memory.dmp
        Download

        memory/4716-381-0x0000000003E00000-0x0000000004572000-memory.dmp
        Download

        memory/4716-723-0x0000000004DD0000-0x0000000005542000-memory.dmp
        Download

        memory/4716-722-0x0000000004DD0000-0x0000000005542000-memory.dmp
        Download

        memory/4716-555-0x0000000004DD0000-0x0000000005542000-memory.dmp
        Download

        memory/4716-554-0x0000000004DD0000-0x0000000005542000-memory.dmp
        Download

        memory/4716-202-0x0000000003E00000-0x0000000004572000-memory.dmp
        Download

        memory/4716-173-0x0000000000850000-0x0000000000FC2000-memory.dmp
        Download

        memory/4716-377-0x0000000003E00000-0x0000000004572000-memory.dmp
        Download

        memory/4844-130-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4876-127-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/4916-96-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download

        memory/5044-176-0x0000000000830000-0x00000000008CC000-memory.dmp
        Download