Overview

overview

9

Static

static

3

2026-09-09...ar.exe

windows10-2004-x64

7

2026-09-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/09/2026, 22:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe
  • Size 2.2MB
  • Sample260909-15kydattev
  • SHA256 ebde7f2db2774f78b6b4bf33edffd6edcbe56635b2efb690498ed63047643178
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\USBMonitorSrv.exe
      /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3552
    • C:\Users\Admin\AppData\Local\Temp\host.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4552
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3700
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:956
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:5112
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3308
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2284
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4724
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:64
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4700
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4376
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1764
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1108
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:1900
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4208
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4264
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4816
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3844
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:4988
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_30b82c70f5d886d1b49eb2078a4afe36_amadey_elex_remcos_smoke-loader_vidar.exe"
      2⤵
      • Executes dropped EXE
      PID:3784
  • C:\USBMonitorSrv.exe
    C:\USBMonitorSrv.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\yyzUSB.exe
      "C:\yyzUSB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\host.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:3872
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3900
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:2636
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Daemon.exe
        • Path C:\Daemon.exe
        • Size 454KB
        • SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 2.1MB
        • SHA256 b62be7ce02ef902a1211a5b7dbe57cc055bb759de20121954e08cbea3f43dc10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 8.0MB
        • SHA256 b70ce49c8d8517f69b2315aee98ce97524a0241197516c6d7b288aeb3abc7be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.2MB
        • SHA256 cb197f2cb8352c51be402ccda99966ab585aa6f74385c688608201a9fb4b3566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.8MB
        • SHA256 ec42b02b4c0e2c5fdbcae20e48144d9d7737c7426cd05eccfed063aacb515efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.0MB
        • SHA256 bfe2d64ea9654b0e8b7d69fa378bbc9f22e9ac97b5539ca3b69cb512efacd2bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 2.1MB
        • SHA256 007c4115d8b20f98dd4b61777f3918228d069dc60b88b0435a754f24b6d2331a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 2.0MB
        • SHA256 e3de682100373be0e3aacda3cb98768f8139051f886e91dac8cfcfb671be1ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 2.1MB
        • SHA256 f4d79fee4fee3613e59d09b0dfdf98477c02101723cd88f8d9d1eca83fa74792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 2.2MB
        • SHA256 d75f3e111128b8b2523dbed7108602172d7852079e4b5d075d99f5923a38ef45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 8.6MB
        • SHA256 29bc40ad23613e566f030414a3435f898921979db572071c5814ba2fdf102c85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.Loader.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 2.0MB
        • SHA256 bd5213e4da40f4c140141f9ed29d5936ce13d433e63baee4575b20acf6696426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NAMECONTROLSERVER.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
        • Size 2.1MB
        • SHA256 5ab76fab6ae4c99979c759d211f13aac7666f2e5c4da6ac3a935c0e237ed4ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OLCFG.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE
        • Size 2.1MB
        • SHA256 501710f4b5a7d45912d028a5fcbed4454ea0428083e460c372ded5d3f44c7b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ONENOTEM.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
        • Size 2.1MB
        • SHA256 7a74c6dc2654a56ee14b298b32129a4fa6be499f5782043cdafc30e382f5d284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        POWERPNT.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
        • Size 3.7MB
        • SHA256 309e6b6d9a6eeb3fb73d2a8ada556019ec694bef6e05ce7593bda18b3cd73a45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDXHelperBgt.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 2.0MB
        • SHA256 44b1a860c716988dd414f788db903a4c1207aae9431db64b8083cd8a3ce81067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SELFCERT.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
        • Size 3.6MB
        • SHA256 381591d56ff3b7288f6c83feab55985ffa418b69a6e7c7b0f4b45dfb5ec5b383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VPREVIEW.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE
        • Size 2.5MB
        • SHA256 fafe7524219371cb5921633a22621bc4d956880f86713daa2b463a9493837759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 2.2MB
        • SHA256 db150607c7070a0315e5a8b50b09c648d5bfce320049ca6459cd5f09fd0a4d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoadfsb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 3.9MB
        • SHA256 7aac8cae6f1cfc80c06db32ec08f0ac6a0a0ec09ca1d35a828ab4528bbd54605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoasb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 2.3MB
        • SHA256 323c32c2d8fa658acdd4013baeacbf877cb6bf2a5c7e4ce215a40cbc371e1242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        officeappguardwin32.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 2.5MB
        • SHA256 1271c7bb12e1d20439e0187bc3983d60c2b1b5c788bc80cfff4848b47ff9f84d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 2.0MB
        • SHA256 c5d793473ae462929dd10788d7ca5381a20f1d5ee5681ac4ea2f04b7c1f7411d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 2.0MB
        • SHA256 43aeaa462fea4ec70cb665b89d770bbdad3f9f2dd4eaed3dd2c2e3a3975117e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USBMonitorSrv.exe
        • Path C:\USBMonitorSrv.exe
        • Size 694KB
        • SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX2933.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX2933.tmp
        • Size 2.0MB
        • SHA256 a063e750700eec9d9273a4726f95f24ad14208f2cc91d09c4dbce7a9818c2d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7DBB.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX7DBB.tmp
        • Size 2.0MB
        • SHA256 dfbe5b4e2b4b97df4e32a32321e52993891720b417b1ae61f02ce65685ec309f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX9DEB.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX9DEB.tmp
        • Size 2.0MB
        • SHA256 1fa0e106b31730779da578d7dbc01655636aa0d7929c475d664bb79eed5be0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXB99C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXB99C.tmp
        • Size 2.0MB
        • SHA256 3c756929bc5d910acac193fbe4d2d0131555d759f6ead68ddd1f12ea3799ba08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXC4C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXC4C.tmp
        • Size 6.1MB
        • SHA256 4a11c6ea7a0ba6e638a1a21c6bc3e0288c934ef987dd2109f5ae4a021da40188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXD51D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXD51D.tmp
        • Size 2.0MB
        • SHA256 8674987367585b64147354c016734c352b5b08c42af9eb120270da7bdba1339c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXE221.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXE221.tmp
        • Size 2.0MB
        • SHA256 4b8ced92c6e110e367b8b6c1132ccd840dfde6b767d0f18318ddd17678923e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host.exe
        • Path C:\Users\Admin\AppData\Local\Temp\host.exe
        • Size 283KB
        • SHA256 5b107f219a97cc6c20e7afc32a4ef8964254e3a5a489151a0212ebed618df799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.4MB
        • SHA256 2be47b0df1d495023eb345132da5827d6cab7cc97b4460310f4908b86c7ce801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 147edf718ba8c35b967bb254360807804fbe0190a7bd46220b1d581d697789b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.1MB
        • SHA256 a5571fb9b1ba7a03c6ee84761b7fd3f7dad4cf9ad47cc74582f252b312a28203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.4MB
        • SHA256 5c7b4c56075039da1dc6f7822daf53c98cbdc15b86df88579e1b1fd21eb08e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 6636931420155dccc897cfb83aed515920afd036c9fe6c0770e72f47fd588669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX446F.tmp
        • Path C:\Windows\SysWOW64\RCX446F.tmp
        • Size 2.2MB
        • SHA256 4de03a4aac28c680ef31b64519afa13c4519f2eafab5d69aa6472d1ba0646df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX5275.tmp
        • Path C:\Windows\SysWOW64\RCX5275.tmp
        • Size 2.8MB
        • SHA256 7c18b82844b2e558a113453612ba23e0f31d39f0b15bdb808f9b6b2628c8da49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXAD60.tmp
        • Path C:\Windows\SysWOW64\RCXAD60.tmp
        • Size 2.0MB
        • SHA256 04e434e50f8fca3eec82410ba041d13194bd7cf3cd8fa82df4818b4487bf0d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXD972.tmp
        • Path C:\Windows\SysWOW64\RCXD972.tmp
        • Size 2.2MB
        • SHA256 05bfd33a7c9588dcc6a5a836aaa3b3600550081c023b229eaebef50afcbd4c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXDBD4.tmp
        • Path C:\Windows\SysWOW64\RCXDBD4.tmp
        • Size 2.4MB
        • SHA256 7139217073c3769abca91912eb99e269e309bb388e76db74c78bbbbaf2868c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.1MB
        • SHA256 7014f61bc4d387af66dea45b4a0dbe9fcff2ececc4965fdd575a122c06d9cbfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.3MB
        • SHA256 037e73c8bd90c2174a94888cef7a79aed5f3b29930e213072f59dc331fa3fb4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Windows\SysWOW64\tempfile
        • Size 2.0MB
        • SHA256 afbcc99a3169045fd8dc5fd56f5b65103a3d4c5c9c4888eff502c868e5c6d80f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        service.log
        • Path C:\service.log
        • Size 429B
        • SHA256 6b26fbf05df66f6417b79929bf25b75d0bb20ba77c547fd64c7c15e05689cfe4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        yyzUSB.exe
        • Path C:\yyzUSB.exe
        • Size 2.2MB
        • SHA256 ebde7f2db2774f78b6b4bf33edffd6edcbe56635b2efb690498ed63047643178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/64-45-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/768-99-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/876-172-0x0000000000AB0000-0x0000000000BA6000-memory.dmp
        Download

        memory/876-66-0x0000000000AB0000-0x0000000000BA6000-memory.dmp
        Download

        memory/956-23-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/1108-106-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/1764-57-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/1900-55-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/1996-326-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-320-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-440-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-468-0x0000000000330000-0x00000000005BF000-memory.dmp
        Download

        memory/1996-194-0x00000000006B0000-0x000000000093F000-memory.dmp
        Download

        memory/1996-477-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-478-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-1793-0x0000000000250000-0x00000000004DF000-memory.dmp
        Download

        memory/1996-237-0x0000000000A90000-0x0000000000CE0000-memory.dmp
        Download

        memory/1996-382-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-381-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-339-0x0000000000A90000-0x0000000000CE0000-memory.dmp
        Download

        memory/1996-1259-0x0000000005AC0000-0x0000000005D4F000-memory.dmp
        Download

        memory/1996-439-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-1258-0x0000000005AC0000-0x0000000005D4F000-memory.dmp
        Download

        memory/1996-82-0x00000000006B0000-0x000000000093F000-memory.dmp
        Download

        memory/1996-258-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-1144-0x0000000005AC0000-0x0000000005D4F000-memory.dmp
        Download

        memory/1996-307-0x0000000000330000-0x00000000005BF000-memory.dmp
        Download

        memory/1996-299-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-1143-0x0000000005AC0000-0x0000000005D4F000-memory.dmp
        Download

        memory/1996-300-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/1996-1955-0x0000000000250000-0x00000000004DF000-memory.dmp
        Download

        memory/1996-257-0x0000000004C80000-0x0000000004F0F000-memory.dmp
        Download

        memory/2092-52-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/2284-30-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/2636-97-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3308-130-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3308-29-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3552-20-0x0000000000AB0000-0x0000000000BA6000-memory.dmp
        Download

        memory/3552-92-0x0000000000AB0000-0x0000000000BA6000-memory.dmp
        Download

        memory/3700-28-0x0000000001088000-0x0000000001089000-memory.dmp
        Download

        memory/3700-22-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3748-522-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1293-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-565-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1261-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1260-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-521-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1292-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-471-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1303-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1304-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-721-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1381-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1384-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1383-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1382-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-495-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1429-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1430-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1531-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1537-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1552-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1553-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1704-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1705-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1765-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1766-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-573-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-96-0x0000000000250000-0x00000000004DF000-memory.dmp
        Download

        memory/3748-496-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-277-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1907-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-1908-0x00000000029A0000-0x0000000002C2F000-memory.dmp
        Download

        memory/3748-270-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-154-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-155-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-8-0x0000000000362000-0x0000000000363000-memory.dmp
        Download

        memory/3748-7-0x0000000000250000-0x00000000004DF000-memory.dmp
        Download

        memory/3748-650-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-649-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-720-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1167-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-1166-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3748-476-0x0000000003D10000-0x0000000003F9F000-memory.dmp
        Download

        memory/3784-53-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3844-51-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/3900-94-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4208-58-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4264-49-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4376-47-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4376-56-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4700-46-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4724-44-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4816-50-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/4988-54-0x0000000001000000-0x000000000109C000-memory.dmp
        Download

        memory/5112-27-0x0000000001000000-0x000000000109C000-memory.dmp
        Download