Overview

overview

7

Static

static

3

2026-05-04...ar.exe

windows10-2004-x64

7

2026-05-04...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
  • Size 6.1MB
  • Sample260504-slbllaav6m
  • SHA256 78d618a224a19164deb853a876f9fb81c154b22b9563e0c6af7615bb9d3ecaa8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\USBMonitorSrv.exe
      /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2240
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3000
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4404
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3232
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4764
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4996
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4852
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3896
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2072
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4348
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2712
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4644
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2948
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2792
    • C:\Users\Admin\AppData\Local\Temp\host.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2864
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3504
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3076
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3136
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3740
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1696
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:5088
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3312
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1412
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4592
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2416
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3300
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4612
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1640
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4688
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2696
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-04_d014cc73256645793f8effed929de0ab_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4708
  • C:\USBMonitorSrv.exe
    C:\USBMonitorSrv.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\yyzUSB.exe
      "C:\yyzUSB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\host.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2088
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:920
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:3828
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:1504

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Daemon.exe
        • Path C:\Daemon.exe
        • Size 454KB
        • SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 2.1MB
        • SHA256 8824dbeb5b8513c85d89882cf1b1a9c17d8c18e6bf3870307b9b08d2de9fe120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.4MB
        • SHA256 2c291bf0aff6b27f5bb15174f7dbd3135ed4e9843b417c7ea4155e6e9d6a6eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.2MB
        • SHA256 18dee00761cf17bc31f1991dac1fe73cb5aa17cf6bb229d5d827fa30d9f20ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.6MB
        • SHA256 06ac69d9484b1dcad694e0a31a3c460c5735718a7f63018451ee8560facb924b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.8MB
        • SHA256 7e68d4d3a9b7692a1535a801c399ca1dae2de20af00a82f9dcef3d720956a9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.4MB
        • SHA256 dd89bea3dde0c83cd503cfc12cf713420b5f8fdea53553781268d5a3f3395052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 2.2MB
        • SHA256 d73738e1d03b6371f3f59957c627ebd83c448fcf717928fdce4213ee62b8a4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 2.1MB
        • SHA256 4e94425a7cc675479cc60d28f1d15f262fc24bf5b6b743c1593f6b00927bd4a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 2.0MB
        • SHA256 76c16b883357006f86403902252a6305989542811899e010430b5ca6241f66ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 2.1MB
        • SHA256 18e6ef969b12abe902dda186aff1abeff16f657cf69306ce3b7413593eb7edb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 2.1MB
        • SHA256 68a6e2302073b46091763d767838add694a33a049683ededa1795c313d5f9557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 2.2MB
        • SHA256 42e96fea4cdde65bd3eeabd81f64e94dc8bd5f1ecfd1c293baff90347e33113f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVLP.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 2.4MB
        • SHA256 cc73f8f4eec9ca06ebf1a7265fa0a16ed15a270725742541b24702e435f97ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 8.6MB
        • SHA256 e7f36b7178fbd109e80b9394bf6e0c44e1b424b64fd4dcaf6d2059bf3b831104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CLVIEW.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
        • Size 2.5MB
        • SHA256 052f3cf7080b2ad5b6dbf1c71b9cdf705fc968c73d85efbb73554e2dfe1a2740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEContentService.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 2.4MB
        • SHA256 bf912595d752fbc322ce3f4def114a62d172b6bb570cb4e6621a2a4809f05076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSQRY32.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE
        • Size 2.8MB
        • SHA256 f103847f1b4b77f7cbd8b9d02c6f15e03a6426c914b889fa48ac37c56be54ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ORGCHART.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE
        • Size 2.6MB
        • SHA256 38251f1f6a7af78b00f65cbf9e6f5524c849b1a25311cfcc120802bc963ace1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SKYPESERVER.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE
        • Size 2.1MB
        • SHA256 804faca55529414a54197bea1244b4cc350da64ff4764465b7c34b4648b9fd27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoadfsb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 3.9MB
        • SHA256 63dadea5f6f587afaad73de90dc16545baa2553162cda2368ed3aba582eb60a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoasb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 2.3MB
        • SHA256 0bc2c4688c709923e9e9b75fd4ec6ed8313c6c36eb5c3fbbb2f64d217b6cdb38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FLTLDR.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
        • Size 2.5MB
        • SHA256 8d863e6597f9fb61c96641095ba1d82e90776c96394566539f3478cf53f7b1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOXMLED.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
        • Size 2.2MB
        • SHA256 51254babd65759c321c3fe3809b924dfbbde5512b6bbb4f567bd6c50aa6fbb0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OLicenseHeartbeat.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
        • Size 3.9MB
        • SHA256 add4a9e2b2ef62c4eba38480a6b1750d660d3d011da1d6292595bf364782e94a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE
        • Size 2.2MB
        • SHA256 b292d80c22b367c0ff7d14759e148be88a4d62ba546434afbb40b6a8eb3ca5fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppSharingHookController.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
        • Size 2.0MB
        • SHA256 d7201417375069dc09deec9035c4e0ea91e5cc3cd9472dfddc28623800c3debb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOHTMED.EXE
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE
        • Size 2.4MB
        • SHA256 641d7b887c262d21125d4cbb197078ad207ade4d0dc4fbe9a5de8fbcfa03c28d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc-cache-gen.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
        • Size 2.1MB
        • SHA256 ec2d5c87b28c803686804446c70f729a209d3fb6f6d003eb70bec04b96d22529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc.exe
        • Size 2.9MB
        • SHA256 0720d7645ddd8941b09691b700d08b19b047e2781b4b3c4e925f8de8b1d38606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EdgeGameAssist.exe
        • Path C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe
        • Size 2.4MB
        • SHA256 f0b1bf918540917190ce351f113c2e31928525fba75624a974a6f6cf6a7b7c49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 2.0MB
        • SHA256 1e62b5ca2365b78cd598caf634af6e9b80ed1599a9ebcf6bf7d26526fa688241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.0MB
        • SHA256 c948adda6c7cbf6444eaa781664ae3e7031a2107facc4f4f6824ac6458346080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.0MB
        • SHA256 7618965e0390b5ded5914257f05dd90af9f401bf6c213c31048862a453e31daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USBMonitorSrv.exe
        • Path C:\USBMonitorSrv.exe
        • Size 694KB
        • SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7162.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX7162.tmp
        • Size 2.1MB
        • SHA256 abeb3bed09189572ffb356c51a7996baf0ce8c62fbe5ac2e42b38a2b1b2b060b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX86B5.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX86B5.tmp
        • Size 2.0MB
        • SHA256 b9dfe492dca47ab33272643fc8e0512e9decc8619bc95ad7012ce3f0c42f94b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX9A53.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX9A53.tmp
        • Size 2.0MB
        • SHA256 c696afe81e876834912f9c5902aa941f0f6b05e600d711aa9a75318078402cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXA2B4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXA2B4.tmp
        • Size 2.0MB
        • SHA256 46fd11724d0e21216ee87421468a471358520ed4643e8ed6a7b25ba2ec38d51f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXA8F1.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXA8F1.tmp
        • Size 2.1MB
        • SHA256 ce334b1aeed83732f057ad5f6557804c3febf90959355ac259f1af2aa7a60074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXBC9E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXBC9E.tmp
        • Size 6.5MB
        • SHA256 854802fe4d51169e756532ac9883e71740dfb04a58a57148448cdb8cf5a344d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXCFB0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXCFB0.tmp
        • Size 2.0MB
        • SHA256 9b6c86183e43161990e39a0b1e3dd7114d1b51195e14fd60adac8d30c1996bf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXE89.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXE89.tmp
        • Size 2.4MB
        • SHA256 3aa710849bd35e583aca4693313a3559842e44b39372db85d23f739b8b9a254c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 fb6a4dc00df1ac9ce9d8d43a16837fdb03cd65fdc7a3fc0c6fe273065f58a278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.8MB
        • SHA256 4075d767ed40df02a34d2590c5b99717008fe2a277a60fd2d0e3aebb5fbe191b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 0a9152d00dee41a3fe9fd17451a75ff80baff1b59c4aefc4c800dd7a8f6cb1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 3.3MB
        • SHA256 08fc87ab88cbad067487b54cffefc311f90df37ce951047b6b6a4ad2cbe434c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 5d304a607b07922d0c8d1ff7c8d49dc39bebf5c89d4a87b3885acd3c58db39cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.1MB
        • SHA256 db55cda2e3ba4e431f92f467d8ced1985e2a8e599d0aaf34f38b5fecdb30c4a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 8.0MB
        • SHA256 9902949f56756d00bf7a8723b827f044ace6d20cdd92a53c2156c235a8ce1a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 13cd6040f2e3c028311a84dce303358ae394cb507317cdcc5c7136ef38f5e317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 ce08ae1504ed0bced88dd93e25f22fc472c2f65e31fd5b9189de1be22901d508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 3.1MB
        • SHA256 56da206ff2332ba2c4f8ed1f225d0665a41586bca8178e704cfe78d53684ce06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 285c62f2247255093a114f42ea8d0490099e659d8589206c887cc2304a49c2f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX5EA5.tmp
        • Path C:\Windows\SysWOW64\RCX5EA5.tmp
        • Size 2.5MB
        • SHA256 d4e15d0164e33a7d5cbfab93ceabc7b86793375b0c3984325e08597037c07500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX64B1.tmp
        • Path C:\Windows\SysWOW64\RCX64B1.tmp
        • Size 2.1MB
        • SHA256 c354a7f671247c0463226e8955a7638a73f00903f77de5787f1144370e9151d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7A1.tmp
        • Path C:\Windows\SysWOW64\RCX7A1.tmp
        • Size 2.0MB
        • SHA256 ab10aa9fea8d58884675f841d5ed0e6bc548c1600bb1cf6ef846c50b110e1e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX9E16.tmp
        • Path C:\Windows\SysWOW64\RCX9E16.tmp
        • Size 2.2MB
        • SHA256 453bfa6f98a2f32a915f049b1a187693e60afb3988bbccf8bc618748972209e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXCB91.tmp
        • Path C:\Windows\SysWOW64\RCXCB91.tmp
        • Size 2.2MB
        • SHA256 b349694f138979226bc2312ffccb5020b713cadedefbeb69793bc8db71428d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXD672.tmp
        • Path C:\Windows\SysWOW64\RCXD672.tmp
        • Size 2.2MB
        • SHA256 c3a541a7e26358323aaebf6c1d0786e8c331e1eb9381c148731faaba4d2650a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXDED1.tmp
        • Path C:\Windows\SysWOW64\RCXDED1.tmp
        • Size 4.7MB
        • SHA256 7da8d455b2848d0f95496bfd3ade2408115f82394ee2fe1bf80c3f553c4a43c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXE0F5.tmp
        • Path C:\Windows\SysWOW64\RCXE0F5.tmp
        • Size 2.0MB
        • SHA256 911c0d4dbf6da7ca1cc714b5394d7f2cff6bb7bed0a947c2e9dfabc148ed8ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXE2FA.tmp
        • Path C:\Windows\SysWOW64\RCXE2FA.tmp
        • Size 2.5MB
        • SHA256 8ee9118bb3899a5dbd81c1afce2aa5dc8887e7ee0842586611c9947acb4c57dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXECCB.tmp
        • Path C:\Windows\SysWOW64\RCXECCB.tmp
        • Size 2.2MB
        • SHA256 7ff62f3edab252fb5ff097cb8aa217146db8441198c42a0d244d6cbb569da483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXF85C.tmp
        • Path C:\Windows\SysWOW64\RCXF85C.tmp
        • Size 2.3MB
        • SHA256 24c2ae29221c0659d015f7febbd764492d84f2265bf1d10dfcfe6bd82c4127d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host.exe
        • Path C:\Windows\SysWOW64\host.exe
        • Size 4.1MB
        • SHA256 78425e626d0830c35ee05307ad6958055493acebbb8a2548ba3de4af6d6378f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 5.3MB
        • SHA256 19fc95dd324acca64071a858ad95ca6810726deb77594b71d5c6f2062d6b7c81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 6.1MB
        • SHA256 78d618a224a19164deb853a876f9fb81c154b22b9563e0c6af7615bb9d3ecaa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.2MB
        • SHA256 e5f78846867cb250569e0db5e437aa87a539500a02391653723c6f32c42a3f16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.2MB
        • SHA256 dd9883e045b050a0918f28a369af8c8e0166f5206f74fbe17b7654aa57dab2a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.0MB
        • SHA256 53735fdab4cf1f0d6eb4dad80b7124763f33e207abda93bba7c90d209ca641e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.9MB
        • SHA256 1d5e9b729f5a91525bd5383f2ec03465083dd8db71991e830b6561f752f491ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.0MB
        • SHA256 c6d5e9bf1be957daa2f62910eef1c6b986c69e302d2f40bba86ba31ab18ff8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        service.log
        • Path C:\service.log
        • Size 429B
        • SHA256 8b03c78584597a40e858609b028ce420115df8cba67761d1a69bf9a54f539bea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/920-149-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/1412-95-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/1504-153-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/1640-102-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/1696-90-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/1800-111-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2024-89-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2072-81-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2088-155-0x000001D980C60000-0x000001D980CFE000-memory.dmp
        Download

        memory/2204-121-0x0000000000A90000-0x0000000000B86000-memory.dmp
        Download

        memory/2204-222-0x0000000000A90000-0x0000000000B86000-memory.dmp
        Download

        memory/2240-60-0x0000000000A90000-0x0000000000B86000-memory.dmp
        Download

        memory/2240-147-0x0000000000A90000-0x0000000000B86000-memory.dmp
        Download

        memory/2416-106-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2696-112-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2712-84-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2792-85-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2864-166-0x00000213ECC50000-0x00000213ECCEE000-memory.dmp
        Download

        memory/2944-94-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2948-83-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/2968-92-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3000-63-0x0000000000D88000-0x0000000000D89000-memory.dmp
        Download

        memory/3000-61-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3016-113-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3076-87-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3136-86-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3232-65-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3300-99-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3312-98-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3504-96-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3740-93-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3828-151-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/3896-88-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4060-309-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-308-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-401-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-359-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-346-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-345-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-322-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-321-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-109-0x0000000000482000-0x0000000000483000-memory.dmp
        Download

        memory/4060-423-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-288-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-287-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-460-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-59-0x0000000000370000-0x00000000009D1000-memory.dmp
        Download

        memory/4060-582-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-175-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-176-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4060-177-0x0000000000370000-0x00000000009D1000-memory.dmp
        Download

        memory/4060-521-0x0000000006870000-0x0000000006ED1000-memory.dmp
        Download

        memory/4348-82-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4404-62-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4592-107-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4612-100-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4644-91-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4688-108-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4708-110-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4764-67-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4852-80-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/4996-68-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download

        memory/5060-239-0x0000000000070000-0x00000000006D1000-memory.dmp
        Download

        memory/5060-137-0x0000000000070000-0x00000000006D1000-memory.dmp
        Download

        memory/5088-97-0x0000000000D00000-0x0000000000D9C000-memory.dmp
        Download