Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 07:43
General
- Target 2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
- Size 6.1MB
- Sample261024-jj73caxy4m
- SHA256 49e1743418039f7a96bb2cdc798e6e61c4aa55526a9fdf2da6009fdd187fc490
Malware Config
Signatures
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 7 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 24 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\USBMonitorSrv.exe/i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Executes dropped EXE
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\host.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b01b47e79e8f9e392f6ba27406ac78a_amadey_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
-
C:\USBMonitorSrv.exeC:\USBMonitorSrv.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\yyzUSB.exe"C:\yyzUSB.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\host.exe"C:\yyzUSB.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Daemon.exe
USBMonitorSrv.exe
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
RCX348A.tmp
host.exe
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
tempfile
service.log
memory/120-449-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/264-448-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/344-463-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/344-414-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/440-447-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/480-461-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/524-479-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/976-430-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/984-432-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1052-466-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1096-412-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1124-480-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1128-468-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1136-456-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1336-451-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1468-474-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1516-476-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1688-434-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1760-462-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1924-445-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1952-438-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/1952-486-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2024-501-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2332-421-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2332-502-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2368-458-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2696-424-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2716-465-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/2740-457-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3192-439-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3260-10-0x0000000000420000-0x0000000000516000-memory.dmp
memory/3304-460-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3552-450-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3564-442-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3676-433-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3696-5-0x0000000000572000-0x0000000000573000-memory.dmp
memory/3696-4-0x0000000000460000-0x0000000000AC1000-memory.dmp
memory/3712-455-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3892-416-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3892-487-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3900-436-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3976-428-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/3976-498-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4072-422-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4072-495-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4124-473-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4156-489-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4212-459-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4284-475-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4352-490-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4420-471-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4432-423-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4464-415-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4464-482-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4560-431-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4560-506-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4696-444-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4732-443-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4788-413-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4884-440-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4912-437-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/4940-435-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5012-503-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5108-505-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5132-453-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5172-420-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5208-491-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5304-454-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5372-427-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5380-493-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5380-419-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5516-470-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5676-441-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5676-496-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5716-452-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5808-446-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5816-483-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5816-426-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5900-425-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/5964-481-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6076-478-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6084-492-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6104-429-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6156-467-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6172-477-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6228-472-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6244-469-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6260-500-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6296-464-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6312-497-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6436-484-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6492-504-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6660-499-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6680-494-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/6780-485-0x0000000000A30000-0x0000000000ACC000-memory.dmp
memory/7024-488-0x0000000000A30000-0x0000000000ACC000-memory.dmp